Stored Cross-Site Scripting Vulnerability in Ibtana WordPress Website Builder Plugin

CVE-2023-6684

What is CVE-2023-6684?

The Ibtana plugin for WordPress is susceptible to Stored Cross-Site Scripting (XSS), enabling authenticated attackers with contributor-level access and above to inject malicious scripts through the 'ive' shortcode. This vulnerability arises from inadequate input sanitization and output escaping of the 'width' and 'height' attributes, allowing harmful scripts to execute on pages viewed by other users. This can lead to unauthorized actions and data exposure, compelling website administrators to apply patches to safeguard their sites and users.

References