PT-2023-16260 · WordPress · Article Directory Wordpress Plugin

Shreya Pohekar · Published 2023-04-10 · Updated 2023-04-14 · CVE-2023-0422

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Article Directory WordPress plugin versions prior to 1.4

Description The issue arises from improper sanitization of the publish terms text setting, which can be exploited to conduct Stored XSS attacks, particularly in multisite environments. This could potentially allow administrators to execute malicious scripts.

Recommendations For Article Directory WordPress plugin versions prior to 1.4, update to version 1.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the administration panel to minimize the risk of exploitation. Avoid using the publish terms text setting in the administration panel until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2023-0422

Affected Products

Article Directory Wordpress Plugin

References · 3

• 🔥 https://wpscan.com/vulnerability/d57f2fb2-5251-4069-8c9a-a4af269c5e62 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-0422 · Security Note
• https://osv.dev/vulnerability/CVE-2023-0422 · Vendor Advisory