Stored Cross-Site Scripting in Ocean Extra oceanwp_library Shortcode

The oceanwp_library shortcode used its id attribute without validating it, and echoed the raw attribute back as template content when no matching library template existed. A contributor-level user who can place the shortcode in a post could inject arbitrary JavaScript that runs in the browser of anyone viewing the page. This vulnerability affects... Weiterlesen