Short Comment Filter WordPress Plugin Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in the Short Comment Filter plugin for WordPress, affecting all versions through 2.2. The issue arises from inadequate input sanitization and the absence of output escaping, allowing authenticated attackers with administrator-level access to inject malicious scripts. These scripts execute when the settings page is accessed, posing a significant risk in WordPress multisite environments or when DISALLOW_UNFILTERED_HTML is enabled.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user visiting the settings page.