Stored Cross-Site Scripting in TaxoPress Plugin for WordPress
CVE-2023-2169

4.8MEDIUM

Key Information:

Vendor

Wordpress
Status
TaxoPress is the WordPress Tag, Category, and Taxonomy Manager
Vendor
CVE Published:
19 April 2023

What is CVE-2023-2169?

The TaxoPress plugin for WordPress is susceptible to Stored Cross-Site Scripting due to inadequate input validation and output escaping in its Related Posts feature. This vulnerability allows authenticated users with Editor+ permissions to insert malicious scripts into web pages. When another user accesses an affected page, the injected script executes, potentially leading to unwanted actions or data exposure.

Affected Version(s)

TaxoPress is the WordPress Tag, Category, and Taxonomy Manager * <= 3.6.4

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/simple-tags/tr...
https://plugins.trac.wordpress.org/changeset?sfp_email=&s...

CVSS V3.1

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Ivan Kuzymchak
.