Stored Cross-Site Scripting in WP Quick FrontEnd Editor Plugin by WordPress
CVE-2021-4378
6.4MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 7 June 2023
What is CVE-2021-4378?
The WP Quick FrontEnd Editor plugin for WordPress has a vulnerability that allows authenticated attackers with minimal permissions to execute arbitrary scripts. This occurs due to inadequate sanitization of input and improper output escaping in the plugin. As a result, any injected scripts can run in the context of an affected user's session whenever they visit a page containing malicious code. This presents a significant risk to users and can lead to potential data breaches or site compromises.
Affected Version(s)
WP Quick FrontEnd Editor – WordPress Plugin * <= 5.5