CVE-2024-8479

HIGH

Simple Spoiler 1.2-1.3 - Unauthenticated Arbitrary Shortcode Execution via Comment Text

Title source: llm
STIX 2.1

Description

The The Simple Spoiler plugin for WordPress is vulnerable to arbitrary shortcode execution in versions 1.2 to 1.3. This is due to the plugin adding the filter add_filter('comment_text', 'do_shortcode'); which will run all shortcodes in comments. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.

References (3)

Core 3

Scores

CVSS v3 7.3
EPSS 0.0056
EPSS Percentile 42.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-94
Status published
Products (1)
webliberty/simple_spoiler 1.2 - 1.4
Published Sep 14, 2024
Tracked Since Feb 18, 2026