Stored Cross-Site Scripting in Jquery News Ticker Plugin for WordPress
CVE-2023-5432
6.4MEDIUM
Summary
The Jquery News Ticker plugin for WordPress contains a vulnerability that allows authenticated attackers, with contributor-level permissions or higher, to exploit insufficient input sanitization and output escaping. Through the 'jquery-news-ticker' shortcode, an attacker can inject arbitrary web scripts into pages. These scripts execute when users access the affected pages, posing a significant risk to user data and site integrity.
Affected Version(s)
Jquery news ticker * <= 3.1
References
CVSS V3.1
Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed
Timeline
Vulnerability published
Vulnerability Reserved
Credit
István Márton