Description
The System Dashboard WordPress plugin before 2.8.15 does not sanitise and escape some parameters when outputting them in the page, which could allow unauthenticated users to perform Cross-Site Scripting attacks.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | System Dashboard | < 2.8.15 | 2.8.15 |
References
- https://wpscan.com/vulnerability/a89f1117-8df3-417b-b54f-6587545833ee/ exploit vdb-entry technical-description