Stored Cross-Site Scripting Vulnerability in User Submitted Posts Plugin for WordPress
CVE-2023-4779

5.4MEDIUM

Key Information:

Vendor
Wordpress
Status
User Submitted Posts – Enable Users to Submit Posts from the Front End
Vendor
CVE Published:
6 September 2023

Summary

The User Submitted Posts plugin for WordPress is susceptible to Stored Cross-Site Scripting attacks through the [usp_gallery] shortcode. This vulnerability arises from inadequate input sanitization and output escaping of user-supplied attributes, such as 'before'. Authenticated attackers with contributor-level permissions or higher can exploit this flaw to embed arbitrary scripts that execute whenever a user accesses the compromised pages, potentially leading to unauthorized actions and data exposure.

Affected Version(s)

User Submitted Posts – Enable Users to Submit Posts from the Front End * <= 20230811

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/changeset/2961841

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

NGÔ THIÊN AN
.