Stored Cross-Site Scripting in TablePress Datetime Shortcode Attribute

A table's datetime format string was interpolated straight into an inline JavaScript command without escaping, so a value containing a quote could break out and execute script in the browser of anyone viewing the table. The format string is now passed through wp_json_encode with JSON_HEX_TAG, which escapes quotes and angle brackets. This... Weiterlesen: Stored Cross-Site Scripting in TablePress Datetime Shortcode Attribute