Stored Cross-Site Scripting Vulnerability in LiteSpeed Cache Plugin for WordPress
CVE-2023-4372
6.4MEDIUM
What is CVE-2023-4372?
The LiteSpeed Cache plugin for WordPress contains a vulnerability that allows authenticated attackers with contributor-level permissions or higher to exploit inadequate input sanitization and output escaping in the 'esi' shortcode. This weakness enables them to inject malicious web scripts into pages, which are executed when users access those compromised pages. Versions up to and including 5.6 are affected, underscoring the importance of updating to protect against potential security breaches.
Affected Version(s)
LiteSpeed Cache 0 <= 5.6
References
EPSS Score
19% chance of being exploited in the next 30 days.
CVSS V3.1
Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed
Timeline
Vulnerability published
Vulnerability Reserved
Credit
István Márton