CVE-2023-0539: GS Insever Portfolio < 1.4.5 - Contributor+ Stored XSS
The GS Insever Portfolio WordPress plugin before 1.4.5 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-0539?
CVE-2023-0539 has a severity level that suggests a medium risk due to the potential for stored cross-site scripting attacks.
How do I fix CVE-2023-0539?
To fix CVE-2023-0539, update the GS Insever Portfolio plugin to version 1.4.5 or later.
What versions are affected by CVE-2023-0539?
CVE-2023-0539 affects all versions of the GS Insever Portfolio plugin prior to 1.4.5.
Who is vulnerable to CVE-2023-0539?
Users with contributor roles and above are vulnerable to CVE-2023-0539 as they can exploit the stored cross-site scripting flaw.
What type of vulnerability is CVE-2023-0539?
CVE-2023-0539 is a stored cross-site scripting vulnerability due to improper validation and escaping of shortcode attributes.