This plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode in all versions up to, and including, 3.1 due to insufficient input sanitization and output escaping on the 'place_id' attribute. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
History

No history.

cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published: 2024-02-05T21:21:56.066Z

Updated: 2024-08-02T08:42:07.970Z

Reserved: 2023-12-16T01:01:04.366Z

Link: CVE-2023-6884

cve-icon Vulnrichment

Updated: 2024-08-02T08:42:07.970Z

cve-icon NVD

Status : Modified

Published: 2024-02-05T22:15:57.057

Modified: 2024-11-21T08:44:45.463

Link: CVE-2023-6884

cve-icon Redhat

No data.