Non notée
CVE-2021-24672 The One User Avatar WordPress plugin before 2.3.7 does not escape the link and target attributes of its shortcode,…
Description
The One User Avatar WordPress plugin before 2.3.7 does not escape the link and target attributes of its shortcode, allowing users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| One User Avatar | User Profile Picture 2.3 | premières → < 2.3.7 | 2.3.7 |