Stored Cross-Site Scripting in Animated Counters Plugin for WordPress

CVE-2023-5774

Summary

The Animated Counters plugin for WordPress is susceptible to Stored Cross-Site Scripting due to inadequate sanitization of user inputs and insufficient output escaping on attributes within shortcodes. This vulnerability allows authenticated attackers with contributor-level permissions or higher to inject malicious scripts. When users access the compromised pages, these injected scripts are executed, potentially leading to data theft, website compromise, or other malicious activities.

References