CVE: CVE-2023-6783
The WolfNet IDX for WordPress plugin through version 1.19.1 does not properly sanitize and escape certain settings. This vulnerability allows high privilege users, such as administrators, to perform Stored Cross-Site Scripting (XSS) attacks, even when the unfiltered_html capability is disabled, which is particularly concerning in multisite setups.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 4.8 | CVE-2023-6783 |
Exploitation
To exploit this vulnerability, an attacker with high privileges can inject malicious scripts into the settings of the WolfNet IDX plugin. This can be done by accessing the plugin’s configuration options and entering untrusted data, which will then be executed in the context of other users who view the affected pages.
Affected Products
- WolfNet IDX for WordPress: A plugin that allows real estate professionals to integrate IDX listings into their WordPress sites, which is vulnerable to XSS attacks due to improper input handling.
Mitigation
To mitigate this vulnerability, it is recommended to update the WolfNet IDX plugin to the latest version where the issue has been addressed. Additionally, administrators should review and sanitize any user inputs and settings to prevent potential XSS attacks.
References