Stored Cross-Site Scripting Vulnerability in Import and Export Users and Customers Plugin for WordPress
CVE-2023-6624

5.4MEDIUM

Key Information:

Vendor
Wordpress
Status
Import and export users and customers
Vendor
CVE Published:
11 January 2024

Summary

The Import and Export Users and Customers Plugin for WordPress is affected by a stored cross-site scripting vulnerability due to inadequate input sanitization and output escaping on user-supplied attributes in its shortcodes. This flaw enables authenticated attackers with contributor-level or higher permissions to inject malicious web scripts into pages. These scripts can execute whenever any user accesses the compromised pages, significantly compromising user security and website integrity.

Affected Version(s)

Import and export users and customers * <= 1.24.3

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/changeset?sfp_email=&s...

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Rafshanzani Suhada
.