Stored Cross-Site Scripting Vulnerability in Import and Export Users and Customers Plugin for WordPress

CVE-2023-6624

What is CVE-2023-6624?

The Import and Export Users and Customers Plugin for WordPress is affected by a stored cross-site scripting vulnerability due to inadequate input sanitization and output escaping on user-supplied attributes in its shortcodes. This flaw enables authenticated attackers with contributor-level or higher permissions to inject malicious web scripts into pages. These scripts can execute whenever any user accesses the compromised pages, significantly compromising user security and website integrity.

References