WordPress · Ongkos Kirim Kurir Instant · CVE-2023-6278
**Name of the Vulnerable Software and Affected Versions**
The Biteship: Plugin Ongkos Kirim Kurir Instant, Reguler, Kargo WordPress plugin versions prior to 2.2.25
**Description**
The issue is related to a Reflected Cross-Site Scripting problem. It occurs because the `biteship error` and `biteship message` parameters are not properly sanitized and escaped before being outputted back on the page. This could be exploited against high-privilege users, such as administrators.
**Recommendations**
For versions prior to 2.2.25, update to version 2.2.25 or later to resolve the issue. As a temporary workaround, consider restricting access to the parameters `biteship error` and `biteship message` to minimize the risk of exploitation.