Stored Cross-Site Scripting in Add Custom Body Class Plugin for WordPress

CVE-2023-5205

What is CVE-2023-5205?

The Add Custom Body Class plugin for WordPress contains a vulnerability that allows authenticated users with contributor-level access or higher to exploit the plugin via Stored Cross-Site Scripting. This occurs due to a lack of proper input sanitization and output escaping for the 'add_custom_body_class' parameter. As a result, attackers can inject malicious scripts into pages, which will execute in the context of the user viewing the page, potentially compromising sensitive information and affecting site security.

References