CVE-2024-12018

Published
View on NVD ↗
CVSS v3
4.3
MEDIUM
CVSS v2
N/A
Affected
1
PROJECT

Description

The Snippet Shortcodes plugin for WordPress is vulnerable to unauthorized Shortcode Deletion due to missing authorization in all versions up to, and including, 4.1.6. Note that a nonce is used as authentication here, but the value is leaked. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete the plugin's Shortcodes.

<blockquote> <p>Create a library of custom shortcodes and reusable content, and seamlessly insert them into your posts and pages for streamlined, consistent site updates. Plus, get a head start with a built-in selection of ready-made shortcodes to use out of the box.</p> </blockquote> <p>In addition to inserting them into your content, you can also <strong>configure them to automatically appear in your site&#8217;s header and footer. Or limit their display to desktop or mobile devices only.</strong></p> <p>Looking to reuse the same snippet of text or HTML across your website while only updating it in one spot? <a href="https://snippetshortcodes.yeken.uk/" rel="nofollow ugc">Snippet Shortcodes</a> could be exactly what you need. With this tool, you can generate a library of custom shortcodes and embed them into your WordPress content. Using the familiar WordPress editor, you can insert anything from text and HTML to JavaScript, images, or any other elements supported by your theme or plugins. The biggest benefit? You only need to create the shortcode once, and you can then deploy it site-wide, saving time and ensuring consistency.</p> <p><em>Quick example</em></p> <p>By default, you tend to create content once and then copy and paste it across your site as needed. Later, when updates are required, you have to track down every instance, edit each one individually, and save every page or post &#8211; making consistent updates a tedious process. Instead, put a snippet like this into one of our <a href="https://yeken.gitbook.io/snippet-shortcodes/features/own-shortcodes" rel="nofollow ugc">custom shortcodes</a> and get a shortcode you can paste into your content. To update, all you need to do is edit the <a href="https://yeken.gitbook.io/snippet-shortcodes/features/own-shortcodes" rel="nofollow ugc">custom shortcode</a> and your entire site will update consistently.</p> <pre><code>&lt;a href="https://www.facebook.com/yekenuk" target="_blank" rel="noopener"&gt;Our Facebook&lt;/a&gt; </code></pre> <p>to</p> <pre><code>[sv slug="facebook-link"] </code></pre> <p><strong>Basic Features</strong></p> <ul> <li><strong><a href="https://yeken.gitbook.io/snippet-shortcodes/features/own-shortcodes" rel="nofollow ugc">Custom shortcodes</a></strong> – Create up to 10 custom shortcodes that can be embedded throughout your website.</li> <li><strong><a href="https://yeken.gitbook.io/snippet-shortcodes/features/own-shortcodes" rel="nofollow ugc">Parameters</a></strong> – Enhance your shortcodes by passing parameters into them e.g. [ sv slug=&#8221;logo&#8221; color=&#8221;blue&#8221; ]</li> <li><strong><a href="https://yeken.gitbook.io/snippet-shortcodes/features/ready-made/core" rel="nofollow ugc">Ready made shortcodes</a></strong> – A collection of ready-made shortcodes for displaying common WordPress fields such as site title, username, admin email, etc.</li> <li><strong>HTML editor</strong> – a HTML editor for editing your <a href="https://yeken.gitbook.io/snippet-shortcodes/features/own-shortcodes" rel="nofollow ugc">custom shortcodes</a>.</li> </ul> <p><strong>Premium Features</strong></p> <ul> <li><strong>Automatically insert into your site&#8217;s header or footer</strong> – auto insert your <a href="https://yeken.gitbook.io/snippet-shortcodes/features/own-shortcodes" rel="nofollow ugc">custom shortcode&#8217;s</a> content into either your site&#8217;s header and/or footer.</li> <li><strong>Limit to certain device types</strong> – specify whether your <a href="https://yeken.gitbook.io/snippet-shortcodes/features/own-shortcodes" rel="nofollow ugc">custom shortcode</a> should only be visible on Mobile, Tablet, Desktop or all three.</li> <li><strong>No limits</strong> – create unlimited <a href="https://yeken.gitbook.io/snippet-shortcodes/features/own-shortcodes" rel="nofollow ugc">custom shortcodes</a>.</li> <li><strong>Inline editor</strong> – Ability to edit <a href="https://yeken.gitbook.io/snippet-shortcodes/features/own-shortcodes" rel="nofollow ugc">custom shortcodes</a> quickly using the inline editor.</li> <li><strong>Duplicator</strong> – Ability to duplicate <a href="https://yeken.gitbook.io/snippet-shortcodes/features/own-shortcodes" rel="nofollow ugc">custom shortcodes</a> with one button click.</li> <li><strong>Enable/Disable</strong> – Ability to enable or disable <a href="https://yeken.gitbook.io/snippet-shortcodes/features/own-shortcodes" rel="nofollow ugc">custom shortcodes</a>.</li> <li><strong>Multi-site</strong> – use <a href="https://yeken.gitbook.io/snippet-shortcodes/features/own-shortcodes" rel="nofollow ugc">custom shortcodes</a> throughout your entire multi-site, not just limited to the one child site. </li> <li><strong><a href="https://yeken.gitbook.io/snippet-shortcodes/features/csv-import" rel="nofollow ugc">CSV import</a></strong> – Bulk import your custom shortcodes.</li> <li><strong><a href="https://yeken.gitbook.io/snippet-shortcodes/features/ready-made/premium/woocommerce-meta-fields" rel="nofollow ugc">WooCommerce fields</a></strong> – A ready-made shortcode to display WooCommerce fields.</li> <li><strong><a href="https://yeken.gitbook.io/snippet-shortcodes/features/ready-made/premium/database-values-by-id" rel="nofollow ugc">Fetch values from database</a></strong> – A ready-made shortcode to fetch a value from any database table.</li> <li>An enhanced <a href="https://yeken.gitbook.io/snippet-shortcodes/features/ready-made/premium" rel="nofollow ugc">collection of ready-made shortcodes</a> for displaying additional WordPress fields, as well as wrapping around PHP functionality like GET/POST values, number of users, etc.</li> </ul> <h3>Pricing Plans</h3> <p>We&#8217;re very transparent on our pricing and usually offer two plans: <em>yearly</em> and <em>lifetime</em>. For further information, please visit <a href="https://shop.yeken.uk/product/shortcode-variables/" rel="nofollow ugc">our upgrade page</a>.</p> <h3>Getting support</h3> <p>If you have a question or an issue, please ask on the plugin&#8217;s <a href="https://wordpress.org/support/plugin/shortcode-variables/" rel="ugc">WordPress support page</a>, and we&#8217;ll be more than happy to help.</p> <h3>Useful links</h3> <ul> <li><a href="https://snippetshortcodes.yeken.uk/" rel="nofollow ugc">Snippet Shortcodes &#8211; Premium</a> – main website for the Premium plugin.</li> <li><a href="https://wordpress.org/plugins/shortcode-variables/" rel="ugc">Snippet Shortcodes &#8211; Core</a> – WordPress.org page for the core plugin.</li> <li><a href="https://yeken.gitbook.io/snippet-shortcodes" rel="nofollow ugc">Technical Documentation</a> – Installation and detailed documentation on how to use the plugin.</li> <li><a href="https://shop.yeken.uk/get-a-trial-license/" rel="nofollow ugc">Trial license</a> – Get a trial license to try out all the features.</li> <li><a href="https://shop.yeken.uk/product/shortcode-variables/" rel="nofollow ugc">Upgrade</a> – purchase a license to receive all of the features.</li> </ul>
WordPress Plugin DirectoryWordPress Plugin Directory
126K