Stored Cross-Site Scripting Vulnerability in Custom Permalinks Plugin for WordPress

CVE-2023-0926

What is CVE-2023-0926?

The Custom Permalinks plugin for WordPress is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability found in versions up to and including 2.6.0. This security flaw emanates from inadequate input sanitization and output escaping on tag names, enabling authenticated users with editor-level permissions or higher to embed arbitrary web scripts into pages. These malicious scripts are then executed when a user accesses the compromised page, even if 'unfiltered_html' is disabled, posing a significant risk to site integrity and user safety.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References