PT-2024-14997 · WordPress · Tj Shortcodes

Dmitry Ignatyev · Published 2024-01-29 · Updated 2024-02-03 · CVE-2023-6530

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions TJ Shortcodes WordPress plugin versions 0.1.3 and earlier

Description The issue concerns the lack of validation and escaping of certain shortcode attributes in the TJ Shortcodes WordPress plugin, which can lead to Stored Cross-Site Scripting attacks. Users with the contributor role and above can potentially exploit this.

Recommendations For TJ Shortcodes WordPress plugin versions 0.1.3 and earlier, consider disabling the vulnerable shortcodes until a patch is available. Restrict access to the shortcode attributes to minimize the risk of exploitation. Avoid using the vulnerable shortcodes in pages or posts until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-6530

Affected Products

Tj Shortcodes

References · 5

• 🔥 https://research.cleantalk.org/cve-2023-6530-tj-shortcodes-stored-xss-poc · Exploit
• 🔥 https://wpscan.com/vulnerability/8e63bf7c-7827-4c4d-b0e3-66354b218bee · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-6530 · Security Note
• https://osv.dev/vulnerability/CVE-2023-6530 · Vendor Advisory
• https://t.me/cvenotify/69869 · Telegram Post