Stored Cross-Site Scripting Vulnerability in Simple Cloudflare Turnstile Plugin for WordPress

CVE-2023-5135

What is CVE-2023-5135?

The Simple Cloudflare Turnstile plugin for WordPress has a vulnerability that allows authenticated users with contributor-level and above permissions to exploit stored cross-site scripting. This occurs through the 'gravity-simple-turnstile' shortcode, where insufficient input sanitization and output escaping for user-supplied attributes permit the injection of arbitrary web scripts into pages. When these altered pages are accessed by other users, the injected scripts are triggered, potentially leading to unauthorized actions and data exposure.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References