WordPress CVEs

Description

The The Special Text Boxes plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 6.2.4. This is due to the plugin adding the filter add_filter('comment_text', 'do_shortcode'); which will run all shortcodes in comments. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.

Affected WordPress components

• Special Text Boxes Plugin · wp-special-textboxes
  Possible match Active
  Up to and including 6.2.4
  View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

• minimus Special Text Boxes — Up to and including 6.2.4
• minimus special_text_boxes — Up to and including 6.2.2
• simplelib special_text_boxes — Up to and including 6.2.2

References

• plugins.trac.wordpress.org https://plugins.trac.wordpress.org/changeset/3166470/
• plugins.trac.wordpress.org https://plugins.trac.wordpress.org/tags/6.2.2/wp-special-textboxes/trunk/stb-class.php#L36
• www.wordfence.com https://www.wordfence.com/threat-intel/vulnerabilities/id/15b2a08f-2122-4eaf-ab46-1945cf6a68ca?source=cve Third Party Advisory
• nvd.nist.gov Official NVD record