Shortcodes Ultimate validated the src attribute of the [su_lightbox] shortcode only against the substring ‘javascript’, or not at all in older releases, so an authenticated Contributor or higher can store a lightbox whose source uses a non-HTTP scheme or encoded payload. The script runs in the browser of any visitor who opens the lightbox. The fix accepts only http(s) URLs, ‘#’ anchors and ‘.’-relative sources.

This vulnerability affects the following application versions:

  • Shortcodes Ultimate – Content Elements 4.0.0
  • Shortcodes Ultimate – Content Elements 4.0.1
  • Shortcodes Ultimate – Content Elements 4.0.3
  • Shortcodes Ultimate – Content Elements 4.0.4
  • Shortcodes Ultimate – Content Elements 4.0.5
  • Shortcodes Ultimate – Content Elements 4.0.6
  • Shortcodes Ultimate – Content Elements 4.0.7
  • Shortcodes Ultimate – Content Elements 4.0.8
  • Shortcodes Ultimate – Content Elements 4.0.9
  • Shortcodes Ultimate – Content Elements 4.1.0
  • Shortcodes Ultimate – Content Elements 4.1.1
  • Shortcodes Ultimate – Content Elements 4.1.2
  • Shortcodes Ultimate – Content Elements 4.1.3
  • Shortcodes Ultimate – Content Elements 4.1.4
  • Shortcodes Ultimate – Content Elements 4.1.5
  • Shortcodes Ultimate – Content Elements 4.1.6
  • Shortcodes Ultimate – Content Elements 4.1.7
  • Shortcodes Ultimate – Content Elements 4.1.8
  • Shortcodes Ultimate – Content Elements 4.1.9
  • Shortcodes Ultimate – Content Elements 4.2.0
  • Shortcodes Ultimate – Content Elements 4.2.1
  • Shortcodes Ultimate – Content Elements 4.2.2
  • Shortcodes Ultimate – Content Elements 4.2.3
  • Shortcodes Ultimate – Content Elements 4.3.0
  • Shortcodes Ultimate – Content Elements 4.3.1
  • Shortcodes Ultimate – Content Elements 4.3.2
  • Shortcodes Ultimate – Content Elements 4.4.0
  • Shortcodes Ultimate – Content Elements 4.4.1
  • Shortcodes Ultimate – Content Elements 4.4.2
  • Shortcodes Ultimate – Content Elements 4.4.3
  • Shortcodes Ultimate – Content Elements 4.4.4
  • Shortcodes Ultimate – Content Elements 4.4.5
  • Shortcodes Ultimate – Content Elements 4.4.6
  • Shortcodes Ultimate – Content Elements 4.5.0
  • Shortcodes Ultimate – Content Elements 4.5.1
  • Shortcodes Ultimate – Content Elements 4.5.2
  • Shortcodes Ultimate – Content Elements 4.5.3
  • Shortcodes Ultimate – Content Elements 4.6.0
  • Shortcodes Ultimate – Content Elements 4.6.1
  • Shortcodes Ultimate – Content Elements 4.6.2
  • Shortcodes Ultimate – Content Elements 4.6.3
  • Shortcodes Ultimate – Content Elements 4.7.0
  • Shortcodes Ultimate – Content Elements 4.7.1
  • Shortcodes Ultimate – Content Elements 4.7.2
  • Shortcodes Ultimate – Content Elements 4.8.0
  • Shortcodes Ultimate – Content Elements 4.8.1
  • Shortcodes Ultimate – Content Elements 4.9.0
  • Shortcodes Ultimate – Content Elements 4.9.1
  • Shortcodes Ultimate – Content Elements 4.9.2
  • Shortcodes Ultimate – Content Elements 4.9.3
  • Shortcodes Ultimate – Content Elements 4.9.4
  • Shortcodes Ultimate – Content Elements 4.9.5
  • Shortcodes Ultimate – Content Elements 4.9.6
  • Shortcodes Ultimate – Content Elements 4.9.7
  • Shortcodes Ultimate – Content Elements 4.9.8
  • Shortcodes Ultimate – Content Elements 4.9.8.1
  • Shortcodes Ultimate – Content Elements 4.9.9
  • Shortcodes Ultimate – Content Elements 4.10.0
  • Shortcodes Ultimate – Content Elements 4.10.1
  • Shortcodes Ultimate – Content Elements 4.10.2
  • Shortcodes Ultimate – Content Elements 5.0.0
  • Shortcodes Ultimate – Content Elements 5.0.1
  • Shortcodes Ultimate – Content Elements 5.0.2
  • Shortcodes Ultimate – Content Elements 5.0.3
  • Shortcodes Ultimate – Content Elements 5.0.4
  • Shortcodes Ultimate – Content Elements 5.0.5
  • Shortcodes Ultimate – Content Elements 5.0.6
  • Shortcodes Ultimate – Content Elements 5.0.7
  • Shortcodes Ultimate – Content Elements 5.0.8
  • Shortcodes Ultimate – Content Elements 5.1.0
  • Shortcodes Ultimate – Content Elements 5.1.1
  • Shortcodes Ultimate – Content Elements 5.2.0
  • Shortcodes Ultimate – Content Elements 5.3.0
  • Shortcodes Ultimate – Content Elements 5.4.0
  • Shortcodes Ultimate – Content Elements 5.4.1
  • Shortcodes Ultimate – Content Elements 5.5.0
  • Shortcodes Ultimate – Content Elements 5.6.0
  • Shortcodes Ultimate – Content Elements 5.6.1
  • Shortcodes Ultimate – Content Elements 5.6.2
  • Shortcodes Ultimate – Content Elements 5.7.0
  • Shortcodes Ultimate – Content Elements 5.8.0
  • Shortcodes Ultimate – Content Elements 5.8.1
  • Shortcodes Ultimate – Content Elements 5.9.0
  • Shortcodes Ultimate – Content Elements 5.9.1
  • Shortcodes Ultimate – Content Elements 5.9.2
  • Shortcodes Ultimate – Content Elements 5.9.3
  • Shortcodes Ultimate – Content Elements 5.9.4
  • Shortcodes Ultimate – Content Elements 5.9.5
  • Shortcodes Ultimate – Content Elements 5.9.6
  • Shortcodes Ultimate – Content Elements 5.9.7
  • Shortcodes Ultimate – Content Elements 5.9.8
  • Shortcodes Ultimate – Content Elements 5.10.0
  • Shortcodes Ultimate – Content Elements 5.10.1
  • Shortcodes Ultimate – Content Elements 5.10.2
  • Shortcodes Ultimate – Content Elements 5.11.0
  • Shortcodes Ultimate – Content Elements 5.11.1
  • Shortcodes Ultimate – Content Elements 5.12.0
  • Shortcodes Ultimate – Content Elements 5.12.1
  • Shortcodes Ultimate – Content Elements 5.12.2
  • Shortcodes Ultimate – Content Elements 5.12.3
  • Shortcodes Ultimate – Content Elements 5.12.5
  • Shortcodes Ultimate – Content Elements 5.12.6
  • Shortcodes Ultimate – Content Elements 5.12.7
  • Shortcodes Ultimate – Content Elements 5.12.8
  • Shortcodes Ultimate – Content Elements 5.12.9
  • Shortcodes Ultimate – Content Elements 5.12.11
  • Shortcodes Ultimate – Content Elements 5.13.0
  • Shortcodes Ultimate – Content Elements 5.13.1
  • Shortcodes Ultimate – Content Elements 5.13.2
  • Shortcodes Ultimate – Content Elements 5.13.3
  • Shortcodes Ultimate – Content Elements 7.0.0
  • Shortcodes Ultimate – Content Elements 7.0.1
  • Shortcodes Ultimate – Content Elements 7.0.2
  • Shortcodes Ultimate – Content Elements 7.0.3
  • Shortcodes Ultimate – Content Elements 7.0.4
  • Shortcodes Ultimate – Content Elements 7.0.5
  • Shortcodes Ultimate – Content Elements 7.1.0
  • Shortcodes Ultimate – Content Elements 7.1.2
  • Shortcodes Ultimate – Content Elements 7.1.3
  • Shortcodes Ultimate – Content Elements 7.1.4
  • Shortcodes Ultimate – Content Elements 7.1.5
  • Shortcodes Ultimate – Content Elements 7.1.6
  • Shortcodes Ultimate – Content Elements 7.1.7
  • Shortcodes Ultimate – Content Elements 7.1.8
  • Shortcodes Ultimate – Content Elements 7.2.1
  • Shortcodes Ultimate – Content Elements 7.2.2
  • Shortcodes Ultimate – Content Elements 7.3.0
  • Shortcodes Ultimate – Content Elements 7.3.1
  • Shortcodes Ultimate – Content Elements 7.3.2
  • Shortcodes Ultimate – Content Elements 7.3.3
  • Shortcodes Ultimate – Content Elements 7.3.4
  • Shortcodes Ultimate – Content Elements 7.3.5
  • Shortcodes Ultimate – Content Elements 7.4.0
  • Shortcodes Ultimate – Content Elements 7.4.1
  • Shortcodes Ultimate – Content Elements 7.4.2
  • Shortcodes Ultimate – Content Elements 7.4.3
  • Shortcodes Ultimate – Content Elements 7.4.4
  • Shortcodes Ultimate – Content Elements 7.4.5
  • Shortcodes Ultimate – Content Elements 7.4.6
  • Shortcodes Ultimate – Content Elements 7.4.7

Skriv et svar

Din e-mailadresse vil ikke blive publiceret. Krævede felter er markeret med *