{"id":41679,"date":"2024-03-12T12:09:07","date_gmt":"2024-03-12T12:09:07","guid":{"rendered":"https:\/\/s.b\/oikcom\/?post_type=oik_pluginversion&p=50385"},"modified":"2024-03-12T14:36:26","modified_gmt":"2024-03-12T14:36:26","slug":"oik-v4-10-2","status":"publish","type":"oik_pluginversion","link":"https:\/\/www.oik-plugins.com\/oik_pluginversion\/oik-v4-10-2\/","title":{"rendered":"oik v4.10.2"},"content":{"rendered":"\n

Update to oik v4.10.2 for a security fix to prevent JavaScript in URLs.<\/p>\n\n\n\n\n\n\n

\"oik<\/figure>\n\n\n

The security issue was responsibly disclosed by Wordfence. Vulnerability Researcher: Francesco Carlucci.<\/p>\n\n\n\n

Vulnerability Title: oik <= 4.10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
CVE ID: CVE-2024-2256
CVSS Severity Score: 6.4 (Medium)
CVSS Vector: CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:C\/C:L\/I:L\/A:N
Organization: Wordfence
Vulnerability Researcher(s): Francesco Carlucci<\/pre>\n\n\n\n
Description<\/h3>\n\n\n\n
The oik plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin’s bw_contact_button and bw_button shortcodes and in all versions up to, and including, 4.10.0, due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.<\/p>\n\n\n\n
Areas affected<\/h3>\n\n\n\n
The issue was reported against the following shortcodes [<\/span>bw_contact_button]<\/a> and [<\/span>bw_button]<\/a> when combined with the link<\/code> attribute.<\/p>\n\n\n\n
The fix also applies to the following shortcodes which were similarly vulnerable.<\/p>\n\n\n\n