Zenost Shortcodes Vulnerability

The Zenost Shortcodes plugin for WordPress is a utility that allows users to add buttons with custom links and targets. However, due to insufficient input sanitization and output escaping, this plugin is vulnerable to Stored Cross-Site Scripting (XSS) attacks. This means that an attacker can inject malicious scripts into the plugin's output, which will be executed by WordPress when a user accesses a page containing the injected script.

You're affected if you use Zenost Shortcodes. Specific version info not stated in the advisory.

To fix this vulnerability, upgrade to Zenost Shortcodes version 1.1 or later. You can do this by:

• Using the WordPress Plugin Update Tool: https://make.wordpress.org/core/2023/02/06/plugin-update-tool/
• Updating your wp-content/plugins directory manually

Immediate mitigations if you cannot upgrade immediately:
- Disable the plugin to prevent further attacks
- Remove the button shortcode from your theme or remove it entirely

• plugins.trac.wordpress.org
• plugins.trac.wordpress.org
• www.wordfence.com