CyberRota Analysis
AI-GeneratedThe WP Highlight Box plugin for WordPress versions up to 1.0 is vulnerable due to improper escaping of shortcode attributes, enabling users with contributor roles and higher to execute Stored Cross-Site Scripting (XSS) attacks. This vulnerability can lead to unauthorized script execution on affected sites, potentially compromising user data and site integrity. WordPress site administrators, particularly those using this plugin, should prioritize patching or disabling the plugin to mitigate the risk.
Original NVD Description
The WP Highlight Box WordPress plugin through 1.0 does not escape some shortcode attributes before outputting them in a page where the shortcode is embedded, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.