https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 29 Oct 2026 20:54:15 +0000 https://db.gcve.eu/vuln/ghsa-6hh4-5cgj-w743 <p>The Post Snippets – Custom WordPress Code Snippets Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 4.2.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Entity-encoded payloads such as &amp;lt;script&amp;gt;...&amp;lt;/script&amp;gt; survive WordPress&#39;s wp_kses_post on-save sanitization because kses does not decode HTML entities, and are only converted back into executable HTML tags at render time by the plugin&#39;s own shortcode filter. This requires snippet shortcodes to be enabled.</p> <p>The Post Snippets – Custom WordPress Code Snippets Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 4.2.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Entity-encoded payloads such as &amp;lt;script&amp;gt;...&amp;lt;/script&amp;gt; survive WordPress&#39;s wp_kses_post on-save sanitization because kses does not decode HTML entities, and are only converted back into executable HTML tags at render time by the plugin&#39;s own shortcode filter. This requires snippet shortcodes to be enabled.</p> https://db.gcve.eu/vuln/ghsa-6hh4-5cgj-w743