Stored Cross-Site Scripting Vulnerability Affects BigBlueButton Plugin for WordPress

CVE-2023-7296

What is CVE-2023-7296?

The BigBlueButton plugin for WordPress features a vulnerability that allows for Stored Cross-Site Scripting in versions up to and including 3.0.0-beta.4. The issue arises from inadequate input sanitization and output escaping in the moderator code and viewer code fields. This vulnerability can be exploited by authenticated users with author privileges or higher, enabling them to inject arbitrary web scripts into pages. If a user is tricked into clicking a malicious link, the injected scripts execute, potentially leading to significant security risks for affected websites.

References