Stored Cross-Site Scripting in PixelYourSite Plugin by WordPress
CVE-2023-2584

4.4MEDIUM

Key Information:

Vendor

WordPress
Status
Pixelyoursite Pro – Your Smart Pixel (tag) Manager
Pixelyoursite – Your Smart Pixel (tag) Manager
Vendor
CVE Published:
9 June 2023

What is CVE-2023-2584?

The PixelYourSite plugin for WordPress is susceptible to Stored Cross-Site Scripting (XSS) due to inadequate sanitization of user inputs in admin settings. This vulnerability affects versions up to 9.3.6 and 9.6.1 in the Pro version, where compromised administrators can inject malicious scripts that execute when users load the affected pages. The issue is particularly critical in multi-site installations or where the unfiltered_html option has been disabled, allowing exploitation of site users without proper defenses.

Affected Version(s)

PixelYourSite – Your smart PIXEL (TAG) Manager * <= 9.3.6

PixelYourSite Pro – Your smart PIXEL (TAG) Manager * <= 9.6.1

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/pixelyoursite/...
https://plugins.trac.wordpress.org/changeset?sfp_email=&s...

CVSS V3.1

Score:
4.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Marco Wotschka
.