CVE-2023-0276: Weaver Xtreme Theme Support < 6.2.7 - Contributor+ Stored XSS

Q: What is the severity of CVE-2023-0276?

The severity of CVE-2023-0276 is medium.

Q: What is the affected software for CVE-2023-0276?

The affected software for CVE-2023-0276 is the Weaver Xtreme Theme Support WordPress plugin version up to 6.2.7.

Q: What is the vulnerability type for CVE-2023-0276?

The vulnerability type for CVE-2023-0276 is Stored Cross-Site Scripting (XSS).

Q: How does CVE-2023-0276 affect users?

CVE-2023-0276 could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.

Q: Is there a fix available for CVE-2023-0276?

Yes, updating to version 6.2.7 of the Weaver Xtreme Theme Support WordPress plugin will fix CVE-2023-0276.

Published Apr 24, 2023

Updated

The Weaver Xtreme Theme Support WordPress plugin before 6.2.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.

Affected Software

1 affected component

Weavertheme Weaver Xtreme Theme Support Wordpress<6.2.7

Event History

Apr 24, 2023

CVE Published

via MITRE·06:30 PM

Data Sourced

via MITRE·06:30 PM

DescriptionWeakness

Data Sourced

via NVD·07:15 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of CVE-2023-0276?

The severity of CVE-2023-0276 is medium.

What is the affected software for CVE-2023-0276?

The affected software for CVE-2023-0276 is the Weaver Xtreme Theme Support WordPress plugin version up to 6.2.7.

What is the vulnerability type for CVE-2023-0276?

The vulnerability type for CVE-2023-0276 is Stored Cross-Site Scripting (XSS).

How does CVE-2023-0276 affect users?

CVE-2023-0276 could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.

Is there a fix available for CVE-2023-0276?