Stored Cross-Site Scripting Vulnerability in PowerPress Plugin for WordPress

CVE-2023-1917

What is CVE-2023-1917?

The PowerPress plugin for WordPress is exposed to a serious Stored Cross-Site Scripting flaw due to inadequate input sanitization and output escaping for user-supplied attributes within its shortcodes. This vulnerability allows authenticated users with contributor-level permissions or higher to insert arbitrary web scripts into WordPress pages, which are executed when any user accesses these compromised pages. A partial fix was implemented in version 10.0.1, followed by a more comprehensive patch in version 10.0.2 to prevent further exploits.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References