Threat Entry Updated 2025-04-23

CVE-2023-4290 - Wp Matterport Shortcode Plugin

The WP Matterport Shortcode WordPress plugin before 2.1.7 does not escape the PHP_SELF server variable when outputting it in attributes, leading to Reflected Cross-Site Scripting issues which could be used against high privilege users such as admin

PLUGIN Wp Matterport Shortcode

CVE-2023-4290

MEDIUM CVSS 6.1 2023-10-16

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2025-04-23

CVE-2023-4289 - Wp Matterport Shortcode Plugin

The WP Matterport Shortcode WordPress plugin before 2.1.8 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks

PLUGIN Wp Matterport Shortcode

CVE-2023-4289

MEDIUM CVSS 5.4 2023-10-16

Risk Score

Open Full Technical Breakdown