Stored Cross-Site Scripting in Weaver Xtreme Theme for WordPress

CVE-2023-6990

What is CVE-2023-6990?

The Weaver Xtreme theme for WordPress is exposed to a Stored Cross-Site Scripting vulnerability due to inadequate sanitization and escaping of user-supplied post meta data. Authenticated users with contributor-level permissions or higher can exploit this weakness to inject malicious web scripts into pages. These scripts trigger whenever an affected page is accessed, potentially compromising user data and site integrity.

References