CVE-2023-0389: Calculated Fields Form < 1.1.151 - Admin+ Stored Cross-Site Scripting via Dropdown Fields
The Calculated Fields Form WordPress plugin before 1.1.151 does not sanitise and escape some of its form settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed (for example in multisite setup)
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-0389?
CVE-2023-0389 has a severity rating that indicates it could result in Stored Cross-Site Scripting attacks for high privilege users.
How do I fix CVE-2023-0389?
To fix CVE-2023-0389, update the Calculated Fields Form WordPress plugin to version 1.1.151 or later.
Who is affected by CVE-2023-0389?
CVE-2023-0389 affects users of the Calculated Fields Form WordPress plugin versions before 1.1.151.
What kind of attacks can CVE-2023-0389 enable?
CVE-2023-0389 can enable Stored Cross-Site Scripting (XSS) attacks on vulnerable installations.
Is unfiltered_html capability relevant to CVE-2023-0389?
Yes, CVE-2023-0389 allows high privilege users to perform attacks even when the unfiltered_html capability is restricted.