ClickFunnels <= 3.1.1 - Contributor+ Stored XSS via Shortcode
published August 16, 2023
CVSS
—
EPSS
0%
Percentile
37.6
In the wild
Unconfirmed
What it is
The ClickFunnels WordPress plugin through 3.1.1 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00444 · 37.6th percentile
Published
2023-08-16T11:03Z
EPSS history
Timeline
16 AUG 11:03Z
ClickFunnels <= 3.1.1 - Contributor+ Stored XSS via Shortcode