Sept. 30, 2023, 3:15 a.m. |

National Vulnerability Database web.nvd.nist.gov

The Blog Filter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'vivafbcomment' shortcode in versions up to, and including, 1.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

attackers attributes blog cross-site cve filter inject input permissions plugin scripting scripts vulnerable web wordpress

Director of the Air Force Cyber Technical Center of Excellence (CyTCoE)

@ Air Force Institute of Technology | Dayton, OH, USA

Senior Cyber Security Analyst

@ Valley Water | San Jose, CA

Infosec Engineer II(3-6 Years)

@ MRI Software | Bengaluru, India Office

Cyber Security Analyst

@ ControlUp | Rishon Lezion

Senior Consultant.e (H/F) - Product & Industrial Cybersecurity - CDI

@ Wavestone | Paris, France

Offensive Security Engineer III

@ Fanatics | India - Hyderabad