CVE-2023-2321: WPForms Google Sheet Connector < 3.4.6 - Reflected XSS
Published Jul 4, 2023
·Updated
The WPForms Google Sheet Connector WordPress plugin before 3.4.6, gsheetconnector-wpforms-pro WordPress plugin through 3.4.6 does not escape a parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Affected Software
2 affected components
GSheetConnector WPForms Google Sheet Connector WordPress<3.4.6
GSheetConnector WPForms Google Sheet Connector WordPress<=3.4.6
Event History
Jul 4, 2023
CVE Published
via MITRE·07:23 AM
Data Sourced
via MITRE·07:23 AM
DescriptionWeakness
Frequently Asked Questions
1
What is the severity of CVE-2023-2321?
The severity of CVE-2023-2321 is rated as medium with a CVSS score of 6.1.
2
What is the vulnerability in the WPForms Google Sheet Connector WordPress plugin before 3.4.6?
The vulnerability in the WPForms Google Sheet Connector plugin before 3.4.6 is a Reflected Cross-Site Scripting (XSS) due to unescaped parameters in attributes.
3
How can the WPForms Google Sheet Connector plugin be affected by CVE-2023-2321?
The gsheetconnector-wpforms-pro plugin through version 3.4.6 is affected by the Reflected Cross-Site Scripting vulnerability.