The Events In City plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'org-events' shortcode in versions up to, and including, 3.0. This is due to insufficient input sanitization and output escaping on user supplied attributes (such as 'organizer_id', 'width', 'height', 'transparency', 'header', 'border', and 'layout') in the org_event_scode() function. The attribute values are concatenated directly into HTML attributes without esc_attr(). This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The Events In City WordPress plugin versions up to 3.0 contains a Stored Cross-Site Scripting vulnerability in the 'org-events' shortcode due to insufficient input sanitization. Authenticated contributors can inject malicious scripts through shortcode attributes that execute when users view affected pages.
تحتوي إضافة Events In City على ثغرة Stored XSS في دالة org_event_scode() حيث يتم دمج قيم السمات مباشرة في خصائص HTML دون تجنب مناسب. يمكن للمستخدمين الذين لديهم صلاحيات المساهم أو أعلى حقن نصوص برمجية ضارة تنفذ عند وصول المستخدمين إلى الصفحات المتأثرة.
The Events In City WordPress plugin versions up to 3.0 contains a Stored Cross-Site Scripting vulnerability in the 'org-events' shortcode due to insufficient input sanitization. Authenticated contributors can inject malicious scripts through shortcode attributes that execute when users view affected pages.
Update the Events In City plugin to version 3.1 or later immediately. Ensure all user input in shortcode attributes is properly sanitized using sanitize_text_field() and escaped using esc_attr() before output. Restrict contributor-level access to trusted users only and monitor for suspicious shortcode usage in page content.
قم بتحديث إضافة Events In City إلى الإصدار 3.1 أو أحدث فوراً. تأكد من تنظيف جميع مدخلات المستخدم في سمات الاختصار باستخدام sanitize_text_field() وتجنب الإخراج باستخدام esc_attr(). قيد الوصول على مستوى المساهم للمستخدمين الموثوقين فقط ومراقبة الاستخدام المريب للاختصارات.