CyberRota Analysis
AI-GeneratedThe Content Mask WordPress plugin prior to version 1.8.5.6 is vulnerable to Stored Cross-Site Scripting (XSS) due to inadequate sanitization and escaping of user-submitted content, allowing users with Contributor roles to inject malicious scripts. This vulnerability can compromise the security of any user viewing or previewing affected pages, potentially leading to data theft or session hijacking. WordPress site administrators using this plugin should prioritize updating to the latest version to mitigate these risks.
Original NVD Description
The Content Mask WordPress plugin before 1.8.5.6 does not properly sanitise and escape content submitted with a post before outputting it in the pages it generates, allowing users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks against any user viewing or previewing the affected page. The Content Mask WordPress plugin before 1.8.5.6's option to restrict its use by role does not prevent this.