Stored Cross-Site Scripting Vulnerability in WP Shortcodes Plugin by WordPress
CVE-2023-6225
5.4MEDIUM
Key Information:
- Vendor
Wordpress
- Vendor
- CVE Published:
- 28 November 2023
What is CVE-2023-6225?
The WP Shortcodes Plugin, specifically the Shortcodes Ultimate component, is exposed to a Stored Cross-Site Scripting vulnerability. This arises from inadequate input sanitization and output escaping, especially when utilizing the su_meta shortcode alongside user-defined meta values. Authenticated attackers possessing contributor-level permissions or higher can exploit this to inject malicious scripts into web pages. Once exploited, these scripts will execute whenever a user accesses the compromised page, potentially leading to unauthorized actions and compromising user data.
Affected Version(s)
WP Shortcodes Plugin — Shortcodes Ultimate * <= 5.13.3