Cross-Site Scripting in Shortcode Factory Plugin for WordPress
CVE-2015-9321

6.1MEDIUM

Key Information:

Vendor

Wordpress
Status
Shortcode Factory
Vendor
CVE Published:
21 August 2019

What is CVE-2015-9321?

The Shortcode Factory plugin for WordPress prior to version 1.1.1 is vulnerable to Cross-Site Scripting (XSS) attacks via the add_query_arg function. This flaw allows attackers to inject malicious scripts, compromising the security of the affected site and potentially leading to unauthorized access or data theft. It is recommended to update to the latest version to mitigate these risks and enhance website security.

References

https://wordpress.org/plugins/shortcode-factory/#developers
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.