Stored Cross-Site Scripting Vulnerability Affects BigBlueButton Plugin for WordPress
CVE-2023-7296

6.4MEDIUM

Key Information:

Vendor
Blindsidenetworks
Status
Bigbluebutton
Vendor
CVE Published:
16 October 2024

Summary

The BigBlueButton plugin for WordPress features a vulnerability that allows for Stored Cross-Site Scripting in versions up to and including 3.0.0-beta.4. The issue arises from inadequate input sanitization and output escaping in the moderator code and viewer code fields. This vulnerability can be exploited by authenticated users with author privileges or higher, enabling them to inject arbitrary web scripts into pages. If a user is tricked into clicking a malicious link, the injected scripts execute, potentially leading to significant security risks for affected websites.

Affected Version(s)

BigBlueButton * <= 3.0.0-beta.4

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/bigbluebutton/...

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Marco Wotschka
.