Vulnerability Details : CVE-2023-6500
The Shariff Wrapper plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'shariff' shortcode in all versions up to, and including, 4.6.9 due to insufficient input sanitization and output escaping on user supplied attributes such as 'secondarycolor' and 'maincolor'. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Vulnerability category: Cross site scripting (XSS)
Products affected by CVE-2023-6500
Please log in to view affected product information.
Exploit prediction scoring system (EPSS) score for CVE-2023-6500
We don't have an EPSS score for this CVE yet
CVSS scores for CVE-2023-6500
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
6.4
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N |
3.1
|
2.7
|
Wordfence | 2024-03-21 |
References for CVE-2023-6500
-
https://www.wordfence.com/threat-intel/vulnerabilities/id/cac2a45e-f09e-4639-9a45-68d528a5094e?source=cve
Shariff Wrapper <= 4.6.9 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode
-
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3030487%40shariff&new=3030487%40shariff&sfp_email=&sfph_mail=
Changeset 3030487 for shariff – WordPress Plugin Repository
Jump to