Stored Cross-Site Scripting in Blog-in-Blog Plugin for WordPress

CVE-2023-2436

What is CVE-2023-2436?

The Blog-in-Blog plugin for WordPress is susceptible to a Stored Cross-Site Scripting vulnerability through the 'blog_in_blog' shortcode in versions up to 1.1.1. Due to inadequate input sanitization and output escaping of user-supplied attributes, authenticated attackers with editor-level permissions can inject malicious web scripts into pages. These scripts execute whenever users access the affected pages, potentially compromising site integrity and user data.

References