Description
The WP Matterport Shortcode WordPress plugin before 2.1.7 does not escape the PHP_SELF server variable when outputting it in attributes, leading to Reflected Cross-Site Scripting issues which could be used against high privilege users such as admin
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | WP Matterport Shortcode | < 2.1.7 | 2.1.7 |
References
- https://wpscan.com/vulnerability/5fad5245-a089-4ba3-9958-1e2c3d066eea exploit vdb-entry technical-description