Description
The Copy Anything to Clipboard for WordPress WordPress plugin before 5.5.5 does not sanitize and escape a shortcode attribute before storing it and writing it back into the page through a client-side script, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks against higher-privileged users who view and interact with the content.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Copy Anything to Clipboard for WordPress | < 5.5.5 | 5.5.5 |
References
- https://wpscan.com/vulnerability/4ee29b7c-ae80-4875-bd78-7128ff4e5e1c/ exploit vdb-entry technical-description