Stored Cross-Site Scripting in Enable Media Replace file_modified Shortcode

The file_modified shortcode used its id and format attributes without sanitising them and passed the format string straight to the date formatter. A contributor-level user who can place the shortcode in a post could inject arbitrary JavaScript that runs in the browser of anyone viewing the page. This vulnerability affects the following application... Weiterlesen