Stored Cross-Site Scripting Vulnerability in Import and Export Users and Customers Plugin for WordPress
CVE-2023-6624
5.4MEDIUM
Key Information:
- Vendor
Wordpress
- Vendor
- CVE Published:
- 11 January 2024
What is CVE-2023-6624?
The Import and Export Users and Customers Plugin for WordPress is affected by a stored cross-site scripting vulnerability due to inadequate input sanitization and output escaping on user-supplied attributes in its shortcodes. This flaw enables authenticated attackers with contributor-level or higher permissions to inject malicious web scripts into pages. These scripts can execute whenever any user accesses the compromised pages, significantly compromising user security and website integrity.
Affected Version(s)
Import and export users and customers * <= 1.24.3