Stored Cross-Site Scripting in Flowpaper Plugin for WordPress

CVE-2023-5200

What is CVE-2023-5200?

The Flowpaper plugin for WordPress is susceptible to stored cross-site scripting (XSS) vulnerabilities through the 'flipbook' shortcode. This vulnerability arises from inadequate input sanitization and output escaping of user-supplied attributes. As a result, individuals with contributor-level access or higher can inject malicious web scripts into pages. These scripts will execute when users visit the affected pages, potentially leading to unauthorized actions or data exposure.

References