Stored Cross-Site Scripting in Page Builder by AZEXO Plugin for WordPress
CVE-2023-3051
5.4MEDIUM
Key Information:
- Vendor
Wordpress
- Vendor
- CVE Published:
- 3 June 2023
What is CVE-2023-3051?
The Page Builder by AZEXO plugin for WordPress is affected by a vulnerability that allows contributor-level attackers to exploit the 'azh_post' shortcode. Due to insufficient input sanitization and output escaping measures, attackers can inject arbitrary web scripts into pages. These scripts execute whenever a user accesses the compromised page, potentially leading to unauthorized actions or data exposure.
Affected Version(s)
Page Builder with Image Map by AZEXO * <= 1.27.133