Stored Cross-Site Scripting Vulnerability in Modal Window Plugin for WordPress

CVE-2023-5161

Summary

The Modal Window plugin for WordPress has a vulnerability that allows authenticated users, specifically those with contributor-level permissions and above, to conduct Stored Cross-Site Scripting attacks. This occurs due to inadequate input sanitization and output escaping of user-supplied attributes in shortcodes. When exploited, it enables attackers to inject arbitrary JavaScript code into web pages. This malicious script executes when users visit the compromised pages, posing risks such as data theft, session hijacking, and other forms of exploitation.

References