ShiftController Employee Shift Scheduling Plugin <=4.9.64 XSS Vulnerability Advisory

From this webpage screenshot, the following key information about the vulnerability can be obtained: 1. Vulnerability Description: - Plugin Name: ShiftController Employee Shift Scheduling Plugin - Version Range: <= 4.9.64 - Vulnerability Type: Cross Site Scripting (XSS) - CVSS Score: 5.9 - Description: Allows malicious attackers to inject malicious scripts into your website, such as redirects, ads, and HTML payloads, which will be executed when visitors access your site. 2. Risk: - Impact: Malicious attackers can exploit this vulnerability to execute malicious scripts on your website. - CVSS Score: 5.9 3. Solution: - Recommendation: Update to version 4.9.65 or higher. - Explanation: Updating to version 4.9.65 or later will remove this vulnerability. Patchstack users can enable automatic updates. 4. Details: - Software: ShiftController Employee Shift Scheduling Plugin - Type: Plugin - Affected Versions: <= 4.9.64 - Fixed Version: 4.9.65 5. Timeline: - Reported: August 15, 2024 - Early Warning Sent: September 23, 2024 - Published: September 25, 2024 6. Additional Information: - Virtual Patch: Virtual patching feature provided by Patchstack. - Purpose of Virtual Patch: A virtual patch is a method to provide security fixes without updating the software. - Why Hackers Target Your Site: Explanation of why hackers may target your website. - Consequences for Compromised Sites: Actions to take if your website has already been attacked. This information helps you understand the severity, scope of impact, and how to resolve and prevent such vulnerabilities.

Goal Reached Thanks to every supporter — we hit 100%!

ShiftController Employee Shift Scheduling Plugin <=4.9.64 XSS Vulnerability Advisory