{"id":4625,"date":"2024-08-29T17:25:09","date_gmt":"2024-08-29T17:25:09","guid":{"rendered":"http:\/\/127.0.0.1\/betheme-tema-de-wordpress-multiproposito-y-woocommerce-27-5-6-cross-site-scripting-almacenado-autenticado-contributor-a-traves-de-shortcode\/"},"modified":"2024-08-29T17:25:09","modified_gmt":"2024-08-29T17:25:09","slug":"betheme-tema-de-wordpress-multiproposito-y-woocommerce-27-5-6-cross-site-scripting-almacenado-autenticado-contributor-a-traves-de-shortcode","status":"publish","type":"post","link":"http:\/\/127.0.0.1\/betheme-tema-de-wordpress-multiproposito-y-woocommerce-27-5-6-cross-site-scripting-almacenado-autenticado-contributor-a-traves-de-shortcode\/","title":{"rendered":"Betheme | Tema de WordPress Multiprop\u00f3sito y WooCommerce &lt;= 27.5.6 &#8211; Cross-Site Scripting Almacenado Autenticado (Contributor+) a trav\u00e9s de Shortcode"},"content":{"rendered":"<div>El tema Betheme para WordPress es vulnerable a Cross-Site Scripting almacenado a trav\u00e9s de varios shortcodes del plugin en todas las versiones hasta, e incluyendo, la 27.5.6 debido a una sanitizaci\u00f3n insuficiente de entrada y escape de salida en los atributos suministrados por el usuario. Esto permite a atacantes autenticados, con acceso de nivel contribuidor y superior, inyectar scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda a una p\u00e1gina inyectada.<\/div>\n<p><\/p>\n<div>Para subsanar este problema, se recomienda a los usuarios actualizar a la \u00faltima versi\u00f3n del tema Betheme lo antes posible, ya que el desarrollador probablemente haya lanzado un parche para corregir esta vulnerabilidad. Adem\u00e1s, es importante que los administradores de sitios web realicen una revisi\u00f3n exhaustiva de los shortcodes utilizados en sus p\u00e1ginas y eliminen aquellos que no sean estrictamente necesarios para reducir la superficie de ataque.<\/div>\n<div>La seguridad en WordPress es fundamental para proteger la integridad y la privacidad de los sitios web. Es crucial estar siempre al tanto de las \u00faltimas actualizaciones y parches de seguridad para prevenir posibles ataques como el Cross-Site Scripting almacenado en el tema Betheme.<\/div>\n","protected":false},"excerpt":{"rendered":"<p>El tema Betheme para WordPress es vulnerable a Cross-Site Scripting almacenado a trav\u00e9s de varios shortcodes del plugin en todas las versiones hasta, e incluyendo, la 27.5.6 debido a una sanitizaci\u00f3n insuficiente de entrada y escape de salida en los atributos suministrados por el usuario. Esto permite a atacantes autenticados, con acceso de nivel contribuidor [&hellip;]<\/p>\n","protected":false},"author":0,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[2314],"class_list":["post-4625","post","type-post","status-publish","format-standard","hentry","category-uncategorized","tag-cve-2024-3998"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v21.8 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Betheme | Tema de WordPress Multiprop\u00f3sito y WooCommerce &lt;= 27.5.6 - Cross-Site Scripting Almacenado Autenticado (Contributor+) a trav\u00e9s de Shortcode - SeguridadWordPress.es<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"http:\/\/127.0.0.1\/betheme-tema-de-wordpress-multiproposito-y-woocommerce-27-5-6-cross-site-scripting-almacenado-autenticado-contributor-a-traves-de-shortcode\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Betheme | Tema de WordPress Multiprop\u00f3sito y WooCommerce &lt;= 27.5.6 - Cross-Site Scripting Almacenado Autenticado (Contributor+) a trav\u00e9s de Shortcode - SeguridadWordPress.es\" \/>\n<meta property=\"og:description\" content=\"El tema Betheme para WordPress es vulnerable a Cross-Site Scripting almacenado a trav\u00e9s de varios shortcodes del plugin en todas las versiones hasta, e incluyendo, la 27.5.6 debido a una sanitizaci\u00f3n insuficiente de entrada y escape de salida en los atributos suministrados por el usuario. Esto permite a atacantes autenticados, con acceso de nivel contribuidor [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"http:\/\/127.0.0.1\/betheme-tema-de-wordpress-multiproposito-y-woocommerce-27-5-6-cross-site-scripting-almacenado-autenticado-contributor-a-traves-de-shortcode\/\" \/>\n<meta property=\"og:site_name\" content=\"SeguridadWordPress.es\" \/>\n<meta property=\"article:published_time\" content=\"2024-08-29T17:25:09+00:00\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"1 minute\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"http:\/\/127.0.0.1\/betheme-tema-de-wordpress-multiproposito-y-woocommerce-27-5-6-cross-site-scripting-almacenado-autenticado-contributor-a-traves-de-shortcode\/\",\"url\":\"http:\/\/127.0.0.1\/betheme-tema-de-wordpress-multiproposito-y-woocommerce-27-5-6-cross-site-scripting-almacenado-autenticado-contributor-a-traves-de-shortcode\/\",\"name\":\"Betheme | Tema de WordPress Multiprop\u00f3sito y WooCommerce &lt;= 27.5.6 - Cross-Site Scripting Almacenado Autenticado (Contributor+) a trav\u00e9s de Shortcode - SeguridadWordPress.es\",\"isPartOf\":{\"@id\":\"http:\/\/127.0.0.1\/#website\"},\"datePublished\":\"2024-08-29T17:25:09+00:00\",\"dateModified\":\"2024-08-29T17:25:09+00:00\",\"author\":{\"@id\":\"\"},\"breadcrumb\":{\"@id\":\"http:\/\/127.0.0.1\/betheme-tema-de-wordpress-multiproposito-y-woocommerce-27-5-6-cross-site-scripting-almacenado-autenticado-contributor-a-traves-de-shortcode\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"http:\/\/127.0.0.1\/betheme-tema-de-wordpress-multiproposito-y-woocommerce-27-5-6-cross-site-scripting-almacenado-autenticado-contributor-a-traves-de-shortcode\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"http:\/\/127.0.0.1\/betheme-tema-de-wordpress-multiproposito-y-woocommerce-27-5-6-cross-site-scripting-almacenado-autenticado-contributor-a-traves-de-shortcode\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"http:\/\/127.0.0.1\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Betheme | Tema de WordPress Multiprop\u00f3sito y WooCommerce &lt;= 27.5.6 &#8211; Cross-Site Scripting Almacenado Autenticado (Contributor+) a trav\u00e9s de Shortcode\"}]},{\"@type\":\"WebSite\",\"@id\":\"http:\/\/127.0.0.1\/#website\",\"url\":\"http:\/\/127.0.0.1\/\",\"name\":\"SeguridadWordPress.es\",\"description\":\"Recopilaci\u00f3n de vulnerabilidades WordPress.\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"http:\/\/127.0.0.1\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Betheme | Tema de WordPress Multiprop\u00f3sito y WooCommerce &lt;= 27.5.6 - Cross-Site Scripting Almacenado Autenticado (Contributor+) a trav\u00e9s de Shortcode - SeguridadWordPress.es","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"http:\/\/127.0.0.1\/betheme-tema-de-wordpress-multiproposito-y-woocommerce-27-5-6-cross-site-scripting-almacenado-autenticado-contributor-a-traves-de-shortcode\/","og_locale":"en_US","og_type":"article","og_title":"Betheme | Tema de WordPress Multiprop\u00f3sito y WooCommerce &lt;= 27.5.6 - Cross-Site Scripting Almacenado Autenticado (Contributor+) a trav\u00e9s de Shortcode - SeguridadWordPress.es","og_description":"El tema Betheme para WordPress es vulnerable a Cross-Site Scripting almacenado a trav\u00e9s de varios shortcodes del plugin en todas las versiones hasta, e incluyendo, la 27.5.6 debido a una sanitizaci\u00f3n insuficiente de entrada y escape de salida en los atributos suministrados por el usuario. Esto permite a atacantes autenticados, con acceso de nivel contribuidor [&hellip;]","og_url":"http:\/\/127.0.0.1\/betheme-tema-de-wordpress-multiproposito-y-woocommerce-27-5-6-cross-site-scripting-almacenado-autenticado-contributor-a-traves-de-shortcode\/","og_site_name":"SeguridadWordPress.es","article_published_time":"2024-08-29T17:25:09+00:00","twitter_card":"summary_large_image","twitter_misc":{"Est. reading time":"1 minute"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"http:\/\/127.0.0.1\/betheme-tema-de-wordpress-multiproposito-y-woocommerce-27-5-6-cross-site-scripting-almacenado-autenticado-contributor-a-traves-de-shortcode\/","url":"http:\/\/127.0.0.1\/betheme-tema-de-wordpress-multiproposito-y-woocommerce-27-5-6-cross-site-scripting-almacenado-autenticado-contributor-a-traves-de-shortcode\/","name":"Betheme | Tema de WordPress Multiprop\u00f3sito y WooCommerce &lt;= 27.5.6 - Cross-Site Scripting Almacenado Autenticado (Contributor+) a trav\u00e9s de Shortcode - SeguridadWordPress.es","isPartOf":{"@id":"http:\/\/127.0.0.1\/#website"},"datePublished":"2024-08-29T17:25:09+00:00","dateModified":"2024-08-29T17:25:09+00:00","author":{"@id":""},"breadcrumb":{"@id":"http:\/\/127.0.0.1\/betheme-tema-de-wordpress-multiproposito-y-woocommerce-27-5-6-cross-site-scripting-almacenado-autenticado-contributor-a-traves-de-shortcode\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["http:\/\/127.0.0.1\/betheme-tema-de-wordpress-multiproposito-y-woocommerce-27-5-6-cross-site-scripting-almacenado-autenticado-contributor-a-traves-de-shortcode\/"]}]},{"@type":"BreadcrumbList","@id":"http:\/\/127.0.0.1\/betheme-tema-de-wordpress-multiproposito-y-woocommerce-27-5-6-cross-site-scripting-almacenado-autenticado-contributor-a-traves-de-shortcode\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"http:\/\/127.0.0.1\/"},{"@type":"ListItem","position":2,"name":"Betheme | Tema de WordPress Multiprop\u00f3sito y WooCommerce &lt;= 27.5.6 &#8211; Cross-Site Scripting Almacenado Autenticado (Contributor+) a trav\u00e9s de Shortcode"}]},{"@type":"WebSite","@id":"http:\/\/127.0.0.1\/#website","url":"http:\/\/127.0.0.1\/","name":"SeguridadWordPress.es","description":"Recopilaci\u00f3n de vulnerabilidades WordPress.","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"http:\/\/127.0.0.1\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"}]}},"amp_enabled":true,"_links":{"self":[{"href":"http:\/\/127.0.0.1\/wp-json\/wp\/v2\/posts\/4625"}],"collection":[{"href":"http:\/\/127.0.0.1\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/127.0.0.1\/wp-json\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"http:\/\/127.0.0.1\/wp-json\/wp\/v2\/comments?post=4625"}],"version-history":[{"count":0,"href":"http:\/\/127.0.0.1\/wp-json\/wp\/v2\/posts\/4625\/revisions"}],"wp:attachment":[{"href":"http:\/\/127.0.0.1\/wp-json\/wp\/v2\/media?parent=4625"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/127.0.0.1\/wp-json\/wp\/v2\/categories?post=4625"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/127.0.0.1\/wp-json\/wp\/v2\/tags?post=4625"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}