Stored Cross-Site Scripting Vulnerability in Photospace Responsive Plugin for WordPress

CVE-2023-4271

What is CVE-2023-4271?

The Photospace Responsive plugin for WordPress is subject to a Stored Cross-Site Scripting vulnerability through the 'psres_button_size' parameter in versions 2.1.1 and below. This flaw arises from inadequate input sanitization and output escaping, which enables authenticated attackers with administrator-level access to inject arbitrary scripts. These scripts can execute when users access the compromised pages, posing a significant risk particularly for multi-site installations where the 'unfiltered_html' option is disabled.

References