Stored Cross-Site Scripting Vulnerability in Display Post Metadata Plugin for WordPress
CVE-2023-1661

5.4MEDIUM

Key Information:

Vendor

Wordpress
Status
Display post meta, term meta, comment meta, and user meta
Vendor
CVE Published:
31 May 2023

What is CVE-2023-1661?

The Display Post Metadata plugin for WordPress has a vulnerability that allows authenticated users, with contributor-level permissions or higher, to exploit insufficient input sanitization and output escaping. This enables the injection of arbitrary web scripts into post metadata, resulting in stored cross-site scripting. Attackers can craft malicious content that, when a user accesses the affected page, executes actions within their session, potentially compromising sensitive data or functionality.

Affected Version(s)

Display post meta, term meta, comment meta, and user meta * <= 0.4.1

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://wordpress.org/plugins/display-metadata/#developers

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Francesco Carlucci
.