Stored Cross-Site Scripting in WP Customer Reviews Plugin for WordPress

CVE-2023-4648

What is CVE-2023-4648?

The WP Customer Reviews plugin for WordPress is prone to a vulnerability that allows authenticated users with administrator-level permissions to perform Stored Cross-Site Scripting attacks via the admin settings. This occurs due to insufficient input sanitization and output escaping. Attackers can inject arbitrary web scripts that will execute whenever a user accesses the affected page. Notably, this vulnerability impacts multi-site installations and environments where unfiltered_html has been disabled.

References