PT-2023-6987 · WordPress · Blog2Social

Erwan Lr · Published 2023-07-31 · Updated 2026-01-06 · CVE-2023-3936

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Blog2Social WordPress plugin versions prior to 7.2.1

Description The issue arises from the plugin's failure to properly sanitise and escape a parameter before outputting it back in the page. This leads to a Reflected Cross-Site Scripting (XSS) vulnerability, which could be exploited against high-privilege users such as administrators. The vulnerability may allow a remote attacker to conduct cross-site scripting attacks.

Recommendations For versions prior to 7.2.1, update to version 7.2.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the plugin's functionality to minimize the risk of exploitation. Avoid using the vulnerable parameter in the affected page until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2023-08006

CVE-2023-3936

Affected Products

Blog2Social

References · 9

• 🔥 https://wpscan.com/vulnerability/6d09a5d3-046d-47ef-86b4-c024ea09dc0f · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-3936 · Security Note
• https://osv.dev/vulnerability/CVE-2023-3936 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-08006 · Security Note
• https://t.me/cvenotify/57300 · Telegram Post
• https://twitter.com/dailycve/status/2008609676397867371 · Twitter Post
• https://vuldb.com/?id.237617 · Note
• https://t.me/cibsecurity/68888 · Telegram Post
• https://wordpress.org/plugins/blog2social · Note