Stored Cross-Site Scripting in CPO Companion Plugin for WordPress

CVE-2023-0162

What is CVE-2023-0162?

The CPO Companion plugin for WordPress is susceptible to Stored Cross-Site Scripting attacks due to inadequate input sanitization and output escaping in its content type settings parameters. This vulnerability allows authenticated users with administrator privileges to inject malicious scripts, which can be executed by unsuspecting users when they access the compromised pages. Attackers can exploit this flaw to manipulate content and gain unauthorized access to sensitive user data.

References