Conversation
supportHi, This just got reported by Patchstack: WP Date and Time Shortcode plugin <= 2.6.7 – Cross Site Scripting (XSS) vulnerability Will there be a fix issued soon? Thanks!
Hello @caordawebsol , Thank you for writing. We still have no detailed information and we are trying to find out what exactly is the issue. Once we know more, we will fix it. Thank you for your patience and understanding. PS: Generally we do not process any data input from the webpages with our shortcodes in any way, so we don’t know how this vulnerability can be exploited if there is such.
I’ve just had an email from WP Engine notifying me of this vulnerability. Patchstack are saying it’s a low severity, but it would be good to get a fix for peace of mind.
Hello, A new version of the plugin 2.6.8 was released. You may update. There was a possible “vulnerability” when a registered contributor creates post or page content using a [wpdts] shortcode in it and purposely places a malicious JavaScript code in the post_id attribute. Then if the submitted content is overlooked and published by the administrator or the editor, the inserted JavaScript may run causing an XSS or other issue. There is no security risk for general blogs or websites managed by their owners where no contributors are publishing or where the administrators and editors watch the content carefully before publishing it.
Brilliant, thank you for a very quick response 😊
I am closing this support thread as resolved. Good luck!
Hello @caordawebsol , Thank you for writing. We still have no detailed information and we are trying to find out what exactly is the issue. Once we know more, we will fix it. Thank you for your patience and understanding. PS: Generally we do not process any data input from the webpages with our shortcodes in any way, so we don’t know how this vulnerability can be exploited if there is such.
I’ve just had an email from WP Engine notifying me of this vulnerability. Patchstack are saying it’s a low severity, but it would be good to get a fix for peace of mind.
Hello, A new version of the plugin 2.6.8 was released. You may update. There was a possible “vulnerability” when a registered contributor creates post or page content using a [wpdts] shortcode in it and purposely places a malicious JavaScript code in the post_id attribute. Then if the submitted content is overlooked and published by the administrator or the editor, the inserted JavaScript may run causing an XSS or other issue. There is no security risk for general blogs or websites managed by their owners where no contributors are publishing or where the administrators and editors watch the content carefully before publishing it.
Brilliant, thank you for a very quick response 😊
I am closing this support thread as resolved. Good luck!