Stored Cross-Site Scripting Vulnerability in Favorites Plugin for WordPress
CVE-2023-2304

5.4MEDIUM

Key Information:

Vendor: Wordpress
Status: Favorites
Vendor: CVE Published:; 31 May 2023

Summary

The Favorites plugin for WordPress is susceptible to Stored Cross-Site Scripting due to inadequate input sanitization and output escaping associated with the 'user_favorites' shortcode. This vulnerability enables authenticated users with contributor-level permissions and above to inject malicious web scripts into pages. These scripts can execute whenever another user accesses these manipulated pages, compromising the integrity and safety of the website.

Affected Version(s)

Favorites * <= 2.3.2

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...

https://plugins.trac.wordpress.org/browser/favorites/tags...

CVSS V3.1

Score:

5.4

Severity:

MEDIUM

Confidentiality:

Low

Integrity:

Low

Availability:

Low

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

Low

User Interaction:

Required

Scope:

Changed

Timeline

Vulnerability published
May 31, 2023
Vulnerability Reserved
Apr 26, 2023

Credit

Lana Codes