CVE-2023-0541: GS Books Showcase < 1.3.1 - Contributor+ Stored XSS
The GS Books Showcase WordPress plugin before 1.3.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-0541?
CVE-2023-0541 is considered a medium-severity vulnerability due to its potential for Stored Cross-Site Scripting (XSS) attacks.
How do I fix CVE-2023-0541?
To fix CVE-2023-0541, update the GS Books Showcase WordPress plugin to version 1.3.1 or later.
Who is affected by CVE-2023-0541?
Users with contributor roles and above are affected by CVE-2023-0541 due to insufficient validation and escaping of shortcode attributes.
What impact does CVE-2023-0541 have?
CVE-2023-0541 allows attackers to inject malicious scripts into pages/posts through the plugin's shortcode, leading to potential data theft or session hijacking.
Which versions of the GS Books Showcase plugin are vulnerable to CVE-2023-0541?
All versions of the GS Books Showcase plugin prior to 1.3.1 are vulnerable to CVE-2023-0541.