Reflected Cross-Site Scripting (XSS) vulnerability in multiple WordPress themes
CVE-2023-28687

7.1HIGH

Key Information:

Vendor: WordPress
Status: Glaze Blog Lite; Fascinate; Cream Blog; Cream Magazine
Vendor: CVE Published:; 26 March 2024

What is CVE-2023-28687?

An improper neutralization of input during web page generation within several WordPress themes has resulted in a Cross-Site Scripting (XSS) vulnerability. This flaw enables attackers to inject arbitrary web scripts into the affected applications. The vulnerability primarily impacts Glaze Blog Lite versions up to 1.1.4, Fascinate versions up to 1.0.8, Cream Blog versions up to 2.1.3, and Cream Magazine versions up to 2.1.4. Successful exploitation could lead to unauthorized actions taken on behalf of users, especially in the context of session hijacking or defacement, highlighting the importance of urgent security remediation for affected users.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch