Stored Cross-Site Scripting Vulnerability in Modern Footnotes Plugin for WordPress

CVE-2023-5618

What is CVE-2023-5618?

The Modern Footnotes plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability in versions up to and including 1.4.16. This issue arises from inadequate sanitization and escaping of user-supplied input within the plugin's shortcode feature. Authenticated attackers with contributor-level access or higher can exploit this vulnerability to inject malicious scripts into the web pages, which will execute whenever users visit the affected pages. This poses a significant risk as it can lead to unauthorized actions and the exposure of sensitive information.

References