PT-2025-21374 · WordPress · Wolfnet Idx

Ma Long · Published 2025-05-15 · Updated 2025-06-11 · CVE-2023-6783

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions WolfNet IDX for WordPress plugin versions 1.19.1 and earlier

Description The issue allows high privilege users, such as admin, to perform Stored Cross-Site Scripting attacks even when the unfiltered html capability is disallowed, for example in a multisite setup. This is due to the plugin not sanitizing and escaping some of its settings.

Recommendations For versions 1.19.1 and earlier, consider disabling the plugin until a patch is available to prevent Stored Cross-Site Scripting attacks. Restrict access to the plugin's settings to minimize the risk of exploitation. Avoid using the plugin in multisite setups where the unfiltered html capability is disallowed until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-6783

Affected Products

Wolfnet Idx

References · 6

• 🔥 https://wpscan.com/vulnerability/5acd231b-4072-4ee1-9497-023465318608 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-6783 · Security Note
• https://osv.dev/vulnerability/CVE-2023-6783 · Vendor Advisory
• https://twitter.com/CVEnew/status/1923119262543249839 · Twitter Post
• https://t.me/cvenotify/125431 · Telegram Post
• https://t.me/cvenotify/123020 · Telegram Post