Stored Cross-Site Scripting Vulnerability in Sitekit Plugin for WordPress

CVE-2023-5071

Summary

The Sitekit plugin for WordPress suffers from a serious stored Cross-Site Scripting vulnerability originating from the 'sitekit_iframe' shortcode. This flaw arises from inadequate input sanitization and output escaping methods implemented in versions up to 1.4. Authenticated attackers with contributor-level access or higher can exploit this vulnerability to inject arbitrary scripts into affected web pages. The injected scripts will execute in the browsers of users who visit the compromised pages, posing significant security risks and potential data breaches.

References