Stored Cross-Site Scripting Vulnerability in WordPress Currency Switcher Plugin by WPCS

CVE-2023-2558

What is CVE-2023-2558?

The WPCS Currency Switcher Professional plugin for WordPress is vulnerable to a Stored Cross-Site Scripting (XSS) attack. This vulnerability arises from insufficient input sanitization and output escaping in the plugin's wpcs_current_currency shortcode. Authenticated attackers with contributor-level permissions or higher can inject malicious scripts that execute whenever a user accesses the compromised pages. It is crucial for site administrators to update to the latest version or apply necessary mitigations to protect against these attacks.

References