The Simple Posts Ticker WordPress plugin before 1.1.6 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Metrics
Affected Vendors & Products
References
History
Wed, 23 Apr 2025 17:15:00 +0000
Type | Values Removed | Values Added |
---|---|---|
Metrics |
ssvc
|

Status: PUBLISHED
Assigner: WPScan
Published: 2023-10-16T19:39:14.025Z
Updated: 2025-04-23T16:12:06.972Z
Reserved: 2023-08-30T18:45:00.305Z
Link: CVE-2023-4646

Updated: 2024-08-02T07:31:06.658Z

Status : Modified
Published: 2023-10-16T20:15:15.830
Modified: 2025-04-23T17:16:45.797
Link: CVE-2023-4646

No data.