Stored Cross-Site Scripting Vulnerability in Custom Permalinks Plugin for WordPress

CVE-2023-0926

What is CVE-2023-0926?

The Custom Permalinks plugin for WordPress is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability found in versions up to and including 2.6.0. This security flaw emanates from inadequate input sanitization and output escaping on tag names, enabling authenticated users with editor-level permissions or higher to embed arbitrary web scripts into pages. These malicious scripts are then executed when a user accesses the compromised page, even if 'unfiltered_html' is disabled, posing a significant risk to site integrity and user safety.

References