PT-2023-28687 · WordPress · User Submitted Posts

Ancorn

+2

·

Published

2023-08-15

·

Updated

2023-08-21

·

CVE-2023-4308

CVSS v3.1

7.2

High

VectorAV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions User Submitted Posts plugin for WordPress versions up to, and including, 20230809
Description The issue is related to Stored Cross-Site Scripting via the user-submitted-content parameter due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Recommendations For versions up to, and including, 20230809, consider disabling the user-submitted-content parameter until a patch is available to prevent exploitation. Restrict access to areas where user-submitted content is displayed to minimize the risk of arbitrary web script execution. Update to a version that includes proper input sanitization and output escaping for the user-submitted-content parameter to fully resolve the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-4308

Affected Products

User Submitted Posts