CVE-2023-0492: GS Products Slider for WooCommerce < 1.5.9 - Contributor+ Stored XSS
The GS Products Slider for WooCommerce WordPress plugin before 1.5.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-0492?
CVE-2023-0492 has a medium severity rating due to its potential for Stored Cross-Site Scripting (XSS) attacks.
How do I fix CVE-2023-0492?
To fix CVE-2023-0492, update the GS Products Slider for WooCommerce WordPress plugin to version 1.5.9 or later.
Who is affected by CVE-2023-0492?
CVE-2023-0492 affects installations of the GS Products Slider plugin for WordPress versions prior to 1.5.9.
What type of attack does CVE-2023-0492 allow?
CVE-2023-0492 allows users with contributor roles or higher to perform Stored Cross-Site Scripting attacks.
What are the consequences of CVE-2023-0492?
The consequences of CVE-2023-0492 include the potential for malicious scripts to be executed on users' browsers, leading to data theft or session hijacking.