Description
The Patterns Kit WordPress plugin through 1.0.3 does not escape a link attribute before its client-side script inserts it into the page, allowing users with a role as low as Contributor to store a payload that executes in the browser of a user who views the content and clicks the affected element.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Patterns Kit | ≤ 1.0.3 | — |
References
- https://wpscan.com/vulnerability/ad42fc34-5d7e-4fb9-98fc-b9e80b552535/ exploit vdb-entry technical-description