CVE-2026-4078
|
| |
|
|
Software afectado |
WORDPRESS |
|
|
|
The ITERAS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple shortcodes (iteras-ordering, iteras-signup, iteras-paywall-login, iteras-selfservice) in all versions up to and including 1.8.2. This is due to insufficient input sanitization and output escaping in the combine_attributes() function. The function directly concatenates shortcode attribute values into JavaScript code within |
Link: |
| https://nvd.nist.gov/vuln/detail/CVE-2026-4078 |
