CVE: CVE-2023-7174
The aBitGone CommentSafe WordPress plugin through version 1.0.0 lacks CSRF checks in certain areas and is missing proper sanitization and escaping. This vulnerability could allow attackers to exploit logged-in administrators by injecting stored XSS payloads through a CSRF attack. As a result, the security of WordPress sites using this plugin is compromised.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7.1 | CVE-2023-7174 |
Exploitation
To exploit this vulnerability, an attacker would need to craft a malicious request that targets a logged-in administrator of a WordPress site using the affected plugin. By tricking the administrator into executing this request, the attacker could inject a stored XSS payload, leading to potential data theft or site compromise.
Affected Products
- aBitGone CommentSafe WordPress plugin (versions <= 1.0.0): This plugin is vulnerable due to the lack of CSRF checks and insufficient sanitization, making it susceptible to XSS attacks.
Mitigation
To mitigate this vulnerability, it is recommended to update the aBitGone CommentSafe plugin to the latest version that includes proper CSRF checks and sanitization measures. Additionally, site administrators should review their security practices to prevent CSRF attacks.
References