CVE-2024-8479 — Simple Spoiler 1.2 - 1.3 - Unauthenticated Arbitrary Shortcode Execution
The The Simple Spoiler plugin for WordPress is vulnerable to arbitrary shortcode execution in versions 1.2 to 1.3. This is due to the plugin adding the filter add_filter('commen…
Published: 2024-09-14 · CVSS: 7.3 · CVSS 3.1
The The Simple Spoiler plugin for WordPress is vulnerable to arbitrary shortcode execution in versions 1.2 to 1.3. This is due to the plugin adding the filter add_filter('comment_text', 'do_shortcode'); which will run all shortcodes in comments. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7