The BWL Advanced FAQ Manager Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'baf_sbox' shortcode in all versions up to and including 1.1.1. This is due to insufficient input sanitization and output escaping on user-supplied shortcode attributes such as 'sbox_id', 'sbox_class', 'placeholder', 'highlight_color', 'highlight_bg', and 'cont_ext_class'. These attributes are directly interpolated into HTML element attributes without any esc_attr() escaping in the baf_sbox() function. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The BWL Advanced FAQ Manager Lite WordPress plugin versions up to 1.1.1 contain a Stored Cross-Site Scripting vulnerability in the 'baf_sbox' shortcode due to insufficient input sanitization. Authenticated users with Contributor access can inject malicious scripts that execute when other users view affected pages.
تحتوي إضافة BWL Advanced FAQ Manager Lite للإصدارات حتى 1.1.1 على ثغرة XSS مخزنة في اختصار 'baf_sbox' حيث لا يتم تنظيف سمات المدخلات مثل 'sbox_id' و 'sbox_class' و 'placeholder' و 'highlight_color' و 'highlight_bg' و 'cont_ext_class' بشكل صحيح. يمكن للمستخدمين المصرح لهم بمستوى المساهم وما فوق حقن نصوص برمجية عشوائية تُنفذ عند وصول المستخدمين الآخرين إلى الصفحات المصابة.
The BWL Advanced FAQ Manager Lite WordPress plugin versions up to 1.1.1 contain a Stored Cross-Site Scripting vulnerability in the 'baf_sbox' shortcode due to insufficient input sanitization. Authenticated users with Contributor access can inject malicious scripts that execute when other users view affected pages.
Update the BWL Advanced FAQ Manager Lite plugin to version 1.1.2 or later immediately. Implement proper input sanitization using sanitize_text_field() and output escaping using esc_attr() for all shortcode attributes. Restrict Contributor-level permissions to trusted users only and monitor user activity for suspicious shortcode usage.
قم بتحديث إضافة BWL Advanced FAQ Manager Lite إلى الإصدار 1.1.2 أو أحدث فوراً. طبق تنظيف المدخلات الصحيح باستخدام sanitize_text_field() وتجنب المخرجات باستخدام esc_attr() لجميع سمات الاختصار. قيد صلاحيات مستوى المساهم للمستخدمين الموثوقين فقط وراقب نشاط المستخدم للكشف عن استخدام اختصار مريب.