Stored Cross-Site Scripting Vulnerability in Garden Gnome Package Plugin for WordPress

CVE-2023-5664

Summary

The Garden Gnome Package plugin for WordPress is susceptible to Stored Cross-Site Scripting through its 'ggpkg' shortcode in all versions up to and including 2.2.8. This vulnerability stems from inadequate input sanitization and output escaping on attributes supplied by users. Authenticated attackers with contributor-level permissions can exploit this flaw to inject arbitrary web scripts into pages, leading to their execution whenever an unsuspecting user accesses the compromised page. A partial patch was implemented in version 2.2.7, with a complete fix introduced in version 2.2.9.

References