Stored Cross-Site Scripting Vulnerability in Spotify Play Button for WordPress Plugin

CVE-2023-1840

What is CVE-2023-1840?

The Spotify Play Button for WordPress plugin is susceptible to Stored Cross-Site Scripting due to improper input sanitization and output escaping in its admin settings. This vulnerability allows authenticated attackers with administrator-level permissions to inject malicious scripts into web pages. When users access these compromised pages, the injected scripts execute, which poses significant security risks, especially in multi-site setups or environments with disabled unfiltered_html.

References