Async JavaScript, 278f7c36-05f8-4b6f-9a13-11175e3f3971

CVE, Research URL: 278f7c36-05f8-4b6f-9a13-11175e3f3971
Home page URL: Security reports for Async JavaScript
Application: Async JavaScript
Published on: -
Research Description: Async JavaScript [async-javascript] < 2.21.06.29 Async JavaScript < 2.21.06.29 - Authenticated (admin+) Stored XSS The plugin does not validate or escape its Username and API Key from the Wizard tab of its settings, allowing high privilege users such as admin to set JavaScript payload in them, even when the unfiltered_html capability is disallowed, leading to Stored Cross-Site Scripting issues
Affected versions: max 2.21.06.29.
Status: vulnerable