Threat Entry Updated 2024-12-12

CVE-2024-11766 - Gs Books Showcase Plugin

The WordPress Book Plugin for Displaying Books in Grid, Flip, Slider, Popup Layout and more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gs_book_showcase' shortcode in all versions up to, and including, 1.3.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Gs Books Showcase

CVE-2024-11766

MEDIUM CVSS 6.4 2024-12-12

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2025-03-12

CVE-2023-0541 - Gs Books Showcase Plugin

The GS Books Showcase WordPress plugin before 1.3.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.

PLUGIN Gs Books Showcase

CVE-2023-0541

MEDIUM CVSS 5.4 2023-02-21

Risk Score

Open Full Technical Breakdown