CVE-2023-2304: Favorites <= 2.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
The Favorites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'userfavorites' shortcode in versions up to, and including, 2.3.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-2304?
CVE-2023-2304 is classified as a high severity vulnerability due to its potential for exploitation via Stored Cross-Site Scripting.
How do I fix CVE-2023-2304?
To fix CVE-2023-2304, upgrade the Favorites plugin for WordPress to version 2.3.3 or later, which includes the necessary security patches.
Who is affected by CVE-2023-2304?
CVE-2023-2304 affects users of the Favorites plugin for WordPress versions up to and including 2.3.2.
What types of attacks can CVE-2023-2304 facilitate?
CVE-2023-2304 can facilitate Stored Cross-Site Scripting attacks that may allow authenticated attackers to execute malicious scripts.
Is it safe to use the Favorites plugin after fixing CVE-2023-2304?
Yes, it is safe to use the Favorites plugin after upgrading to the patched version that resolves CVE-2023-2304.