CVE-2023-4963

EPSS 0.13%
Veröffentlicht 15.09.2023 03:15:09
Zuletzt bearbeitet 21.11.2024 08:36:21
Quelle security@wordfence.com
CVE-Watchlists
Login
Unerledigt
Login

WS Facebook Like Box Widget <= 5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The WS Facebook Like Box Widget for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'ws-facebook-likebox' shortcode in versions up to, and including, 5.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Mögliche Gegenmaßnahme

WS Facebook Like Box Widget: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.