CVE-2023-1403: Weaver Xtreme Theme <= 5.0.7 - Authenticated(Contributor+) Stored Cross-Site Scripting via Display Name
The Weaver Xtreme Theme for WordPress is vulnerable to stored Cross-Site Scripting due to insufficient escaping of the profile display name in versions up to, and including, 5.0.7. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the vulnerability ID for this Weaver Xtreme Theme for WordPress vulnerability?
The vulnerability ID for this Weaver Xtreme Theme for WordPress vulnerability is CVE-2023-1403.
What is the severity of CVE-2023-1403 vulnerability?
The severity of CVE-2023-1403 vulnerability is medium with a CVSS score of 5.4.
How does the vulnerability in Weaver Xtreme Theme for WordPress impact the website?
The vulnerability in Weaver Xtreme Theme for WordPress allows authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts, leading to possible cross-site scripting attacks.
Which versions of Weaver Xtreme Theme for WordPress are affected by vulnerability CVE-2023-1403?
Versions up to, and including, 5.0.7 of Weaver Xtreme Theme for WordPress are affected by vulnerability CVE-2023-1403.
How can I fix the vulnerability in Weaver Xtreme Theme for WordPress?
To fix the vulnerability in Weaver Xtreme Theme for WordPress, it is recommended to update to a patched version of the theme, if available. Additionally, web application firewalls (WAFs) or security plugins can help mitigate the risk of cross-site scripting attacks.