CVE-2023-5334

EPSS 0.13%
Veröffentlicht 03.10.2023 02:15:10
Zuletzt bearbeitet 21.11.2024 08:41:33
Quelle security@wordfence.com
CVE-Watchlists
Login
Unerledigt
Login

WP Responsive header image slider <= 3.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The WP Responsive header image slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'sp_responsiveslider' shortcode in versions up to, and including, 3.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Mögliche Gegenmaßnahme

WP Responsive header image slider: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.