CVE-2024-3773 PUBLISHED

LiveJournal Shortcode <= 1.1.1 - Contributor+ Stored XSS via Shortcode

Assigner: WPScan
Reserved: 15.04.2024 Published: 02.09.2026 Updated: 02.09.2026

The LiveJournal Shortcode WordPress plugin through 1.1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
CVSS Score: 5.9

Attack Vector	Network	Scope	Changed
Attack Complexity	Low	Confidentiality Impact	Low
Privileges Required	High	Integrity Impact	Low
User Interaction	Required	Availability Impact	Low

CVSS 3.1

Product Status

Vendor	Unknown
Product	LiveJournal Shortcode
Versions	Default: unknown affected from 0 to 1.1.1 (incl.)

Credits

Bob Matyas finder
WPScan coordinator

References

https://wpscan.com/vulnerability/b2c7d31d-8d9f-4c79-b01b-fc350c60a528/

Problem Types

CWE-79 Cross-Site Scripting (XSS) CWE