Stored Cross-Site Scripting Vulnerability in GEO my WP Plugin

CVE-2023-5467

Summary

The GEO my WordPress plugin for WordPress is affected by a serious vulnerability that enables stored cross-site scripting. This issue arises from inadequate input sanitization and output escaping applied to user-supplied attributes in shortcodes. As a result, authenticated users with contributor-level permissions or higher can inject malicious scripts into pages. These scripts will then execute whenever a user visits a compromised page, potentially compromising user trust and site integrity.

References