MDTF WordPress plugin stored cross-site scripting via vars parameter
A WordPress filter plugin lets attackers plant scripts that hit visitors.
Summary
Insufficient input sanitization and output escaping in the MDTF plugin's 'vars' parameter lets unauthenticated attackers inject scripts into pages. All versions up to and including 1.4.1 are affected, and the scripts run for users who open a published page containing the [meta_data_filter_results] shortcode.
Affected when
- a published page or post containing the [meta_data_filter_results] shortcode
What to do
All versions up to and including 1.4.1 are affected. Check that your plugin is newer than 1.4.1, and read the vendor's advisory.
Products and platforms
CVE IDs
Sources
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen