| Package | Affected versions | Patched versions |
|---|---|---|
| gistpress | < 3.0.2 | 3.0.2 |
XSS exists in the shortcode functionality of the GistPress plugin before 3.0.2 for WordPress via the includes/class-gistpress.php id parameter. This allows an attacker with the WordPress Contributor role to execute arbitrary JavaScript code with the privileges of other users (e.g., ones who have the publish_posts capability).
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free