Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Qyrr < 0.7 - Authenticated (contributor+) Stored XSS
Vulnerability Description
The Qyrr WordPress plugin before 0.7 does not escape the data-uri of the QR Code when outputting it in a src attribute, allowing for Cross-Site Scripting attacks. Furthermore, the data_uri_to_meta AJAX action, available to all authenticated users, only had a CSRF check in place, with the nonce available to users with a role as low as Contributor allowing any user with such role (and above) to set a malicious data-uri in arbitrary QR Code posts, leading to a Stored Cross-Site Scripting issue.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
WordPress plugin Qyrr 安全漏洞
Vulnerability Description
WordPress和WordPress plugin都是WordPress基金会的产品。WordPress是一套使用PHP语言开发的博客平台。该平台支持在PHP和MySQL的服务器上架设个人博客网站。WordPress plugin是一个应用插件。 WordPress plugin Qyrr 0.7 版本之前存在安全漏洞，该漏洞源于在 src 属性中输出 QR 码时，不会转义 QR 码的 data-uri，从而允许跨站脚本攻击。此外，对所有经过身份验证的用户可用的 data_uri_to_meta AJA
CVSS Information
N/A
Vulnerability Type
N/A