CVE-2023-25040: WordPress Shortcodes Ultimate Plugin <= 5.12.6 is vulnerable to Cross Site Scripting (XSS)

Q: What is CVE-2023-25040?

CVE-2023-25040 is a Stored Cross-Site Scripting (XSS) vulnerability in the Vova Anokhin WordPress Shortcodes Plugin - Shortcodes Ultimate plugin versions <= 5.12.6.

Q: How severe is CVE-2023-25040?

CVE-2023-25040 has a severity score of 5.4, which is considered medium.

Q: What is the affected software for CVE-2023-25040?

The affected software for CVE-2023-25040 is the Getshortcodes Shortcodes Ultimate plugin versions up to 5.12.6 for WordPress.

Q: How can I fix CVE-2023-25040?

To fix CVE-2023-25040, update your Getshortcodes Shortcodes Ultimate plugin to version 5.12.7 or higher.

Q: What is the Common Weakness Enumeration (CWE) for CVE-2023-25040?

The Common Weakness Enumeration (CWE) for CVE-2023-25040 is CWE-79 (Improper Neutralization of Input During Web Page Generation).

Published Mar 30, 2023

Updated

Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Vova Anokhin WordPress Shortcodes Plugin — Shortcodes Ultimate plugin <= 5.12.6 versions.

Affected Software

1 affected component

Getshortcodes Shortcodes Ultimate Wordpress<5.12.7

Remediation

Information

Update to 5.12.7 or a higher version.

Event History

Mar 30, 2023

CVE Published

via MITRE·11:10 AM

Data Sourced

via MITRE·11:10 AM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

What is CVE-2023-25040?

CVE-2023-25040 is a Stored Cross-Site Scripting (XSS) vulnerability in the Vova Anokhin WordPress Shortcodes Plugin - Shortcodes Ultimate plugin versions <= 5.12.6.

How severe is CVE-2023-25040?

CVE-2023-25040 has a severity score of 5.4, which is considered medium.

What is the affected software for CVE-2023-25040?