Vulnerabilities

TI-2023-28340 CVE-2023-51694 · GHSA-283m-jhf4-68hp

WordPress Embed Privacy Plugin <= 1.8.0 is vulnerable to Cross Site Scripting (XSS)

LOW 29

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Epiphyt Embed Privacy allows Stored XSS.This issue affects Embed Privacy: from n/a through 1.8.0.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00289 Published 2024-02-01 No fix listed CWE-79

TI-2023-26163 CVE-2023-48300

Embed Privacy missing escaping for show_all attribute in opt-out shortcode

MEDIUM 61

The `Embed Privacy` plugin for WordPress that prevents the loading of embedded external content is vulnerable to Stored Cross-Site Scripting via `embed_privacy_opt_out` shortcode in versions up to, and including, 1.8.0 d…

CVSS 3.1MEDIUM 6.3 Network Low privileges No interaction EPSS 0.00527 Published 2023-11-20 Fixed in 1.8.1 CWE-79

Vulnerabilities

Filters

WordPress Embed Privacy Plugin <= 1.8.0 is vulnerable to Cross Site Scripting (XSS)

Embed Privacy missing escaping for show_all attribute in opt-out shortcode