Feb. 6, 2023, 8:15 p.m. |

National Vulnerability Database web.nvd.nist.gov

The PDF.js Viewer WordPress plugin before 2.1.8 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.

attacks attributes back cross-site cve escape pdf plugin role scripting viewer wordpress wordpress plugin

SOC 2 Manager, Audit and Certification

@ Deloitte | US and CA Multiple Locations

Security Engineer II, Offensive Security Penetration Testing

@ Amazon.com | US, TX, Virtual Location - Texas

Cybersecurity Specialist (Security Engineering)

@ Triton AI Pte Ltd | Singapore, Singapore, Singapore

Information Systems Security Officer (ISSO)

@ ARA | Arlington, Virginia, United States

Lead - IT Risk compliance & Info Security

@ First Advantage | Bengaluru-560042, Karnataka

Embedded VSOC Analyst

@ Sibylline Ltd | Australia, Australia