Stored Cross-Site Scripting Vulnerability in Live Updates from Excel Plugin for WordPress

CVE-2023-5116

What is CVE-2023-5116?

The Live Updates from Excel plugin for WordPress, through its 'ipushpull_page' shortcode, is susceptible to a stored cross-site scripting vulnerability. This flaw arises from inadequate input sanitization and output escaping on user-supplied attributes, allowing authenticated attackers with contributor-level permissions or higher to inject arbitrary web scripts. These scripts are executed whenever a user accesses an affected page, posing significant risks to site security and user data integrity.

References