Stored Cross-Site Scripting Vulnerability in User Submitted Posts Plugin for WordPress
CVE-2023-4779
6.4MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 6 September 2023
What is CVE-2023-4779?
The User Submitted Posts plugin for WordPress is susceptible to Stored Cross-Site Scripting attacks through the [usp_gallery] shortcode. This vulnerability arises from inadequate input sanitization and output escaping of user-supplied attributes, such as 'before'. Authenticated attackers with contributor-level permissions or higher can exploit this flaw to embed arbitrary scripts that execute whenever a user accesses the compromised pages, potentially leading to unauthorized actions and data exposure.
Affected Version(s)
User Submitted Posts – Enable Users to Submit Posts from the Front End * <= 20230811