【資安通報】
風險等級(滿分為10分): 6.4
受影響版本: <= 7.5
簡述:
外掛存在著透過自訂標題標籤屬性的儲存型跨網站指令碼（XSS）漏洞，原因是對於使用者提供的輸入未進行足夠的輸入驗證和輸出轉義處理。這使得已驗證的攻擊者（具有投稿者等級或更高權限）可以在頁面中注入任意的網頁指令碼，在訪問被注入頁面時將會執行該指令碼。
參考資料:
- https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/js_composer-2/wpbakery-visual-composer-75-authenticated-contributor-stored-cross-site-scripting-via-button-onclick-attribute
- https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/js_composer-2/wpbakery-visual-composer-75-authenticated-contributor-stored-cross-site-scripting-via-post-title-tag-attribute
- https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/js_composer-2/wpbakery-visual-composer-75-authenticated-contributor-stored-cross-site-scripting-via-button-onclick-attribute-1
- https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/js_composer-2/wpbakery-visual-composer-75-authenticated-contributor-stored-cross-site-scripting-via-custom-heading-tag-attribute
#大邵報資安
#WordPress
