Stored Cross-Site Scripting in WCFM Marketplace Plugin for WordPress

CVE-2023-4960

What is CVE-2023-4960?

The WCFM Marketplace plugin for WordPress contains a Stored Cross-Site Scripting vulnerability linked to the 'wcfm_stores' shortcode. This issue arises from inadequate sanitization and escaping of user-supplied data, allowing attackers with contributor-level permissions or higher to embed malicious web scripts. These scripts are executed in the browsers of users visiting the manipulated pages, posing serious security risks for both site administrators and users. Prompt action is required to mitigate these risks by updating to the latest plugin version.

References