CVE-2023-0540: GS Filterable Portfolio < 1.6.1 - Contributor+ Stored XSS
The GS Filterable Portfolio WordPress plugin before 1.6.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-0540?
CVE-2023-0540 has a medium severity rating due to its potential for Stored Cross-Site Scripting attacks.
How do I fix CVE-2023-0540?
To fix CVE-2023-0540, update the GS Filterable Portfolio plugin to version 1.6.1 or later.
What versions of the GS Filterable Portfolio plugin are affected by CVE-2023-0540?
Versions of the GS Filterable Portfolio plugin prior to 1.6.1 are affected by CVE-2023-0540.
Who is vulnerable to CVE-2023-0540?
Users with contributor roles and above on WordPress sites using affected versions of the GS Filterable Portfolio plugin are vulnerable to CVE-2023-0540.
What are the implications of CVE-2023-0540?
CVE-2023-0540 could allow attackers to inject malicious scripts into web pages, potentially compromising user data and site integrity.