Stored Cross-Site Scripting Vulnerability in Blog Filter Plugin for WordPress
CVE-2023-5291

6.4MEDIUM

Key Information:

Vendor
WordPress
Status
Blog Filter – Advanced Post Filtering With Categories Or Tags, Post Portfolio Gallery, Blog Design Template, Post Layout
Vendor
CVE Published:
4 October 2023

Summary

The Blog Filter plugin for WordPress suffers from a Stored Cross-Site Scripting issue due to inadequate sanitization of user input and escaping of output. This vulnerability impacts versions up to and including 1.5.3. Authenticated attackers with contributor-level roles can exploit this risk by using the 'AWL-BlogFilter' shortcode to inject malicious web scripts into pages. The injected scripts execute whenever any user accesses these compromised pages, potentially leading to unauthorized actions or data theft.

Affected Version(s)

Blog Filter – Advanced Post Filtering with Categories Or Tags, Post Portfolio Gallery, Blog Design Template, Post Layout * <= 1.5.3

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/blog-filter/ta...
https://plugins.trac.wordpress.org/changeset/2974261/blog...

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Lana Codes
.