The WP Matterport Shortcode WordPress plugin before 2.1.7 does not escape the PHP_SELF server variable when outputting it in attributes, leading to Reflected Cross-Site Scripting issues which could be used against high privilege users such as adminCreditsErwan LR (WPScan)WPScanReferenceshttps://wpscan.com/vulnerability/5fad5245-a089-4ba3-9958-1e2c3d066eea
