Stored Cross-Site Scripting Vulnerability in Amazonify Plugin for WordPress

CVE-2023-5819

Summary

The Amazonify plugin for WordPress is exposed to a Stored Cross-Site Scripting vulnerability due to inadequate input sanitization and lack of output escaping within its admin settings. This flaw allows authenticated attackers, with administrator privileges, to inject malicious scripts that execute when users interact with compromised pages. The vulnerability primarily affects installations that have multi-site configurations or where the 'unfiltered_html' option is disabled. It’s crucial to note that this issue can be exploited alongside another vulnerability, facilitating broader CSRF to XSS attack vectors.

References