First published: Mon Jun 05 2023(Updated: )
The Hostel WordPress plugin before 1.1.5.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Credit: contact@wpscan.com
Affected Software | Affected Version | How to fix |
---|---|---|
Kibokolabs Hostel | <=1.1.5 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
CVE-2023-0545 is a vulnerability in the Hostel WordPress plugin before version 1.1.5.2 that could allow high privilege users to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
CVE-2023-0545 affects the Hostel WordPress plugin before version 1.1.5.2 by not sanitizing and escaping some of its settings, enabling high privilege users to perform Stored Cross-Site Scripting attacks.
The severity of CVE-2023-0545 is medium with a severity value of 4.8.
CVE-2023-0545 can be exploited by high privilege users, such as admin, to perform Stored Cross-Site Scripting attacks.
Yes, the fix for CVE-2023-0545 is to upgrade the Hostel WordPress plugin to version 1.1.5.2 or later.