CVE-2023-2558: WPCS – WordPress Currency Switcher Professional <= 1.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
The WPCS – WordPress Currency Switcher Professional plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpcscurrentcurrency shortcode in versions up to, and including, 1.1.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2023-2558?
CVE-2023-2558 is a vulnerability in the WPCS - WordPress Currency Switcher Professional plugin for WordPress.
How does CVE-2023-2558 affect the WPCS - WordPress Currency Switcher Professional plugin?
CVE-2023-2558 allows for Stored Cross-Site Scripting via the plugin's wpcs_current_currency shortcode.
What is the severity of CVE-2023-2558?
CVE-2023-2558 has a severity rating of medium, with a CVSS score of 5.4.
How can I fix CVE-2023-2558?
To fix CVE-2023-2558, update the WPCS - WordPress Currency Switcher Professional plugin to version 1.2.0 or higher.
Where can I find more information about CVE-2023-2558?
You can find more information about CVE-2023-2558 in the references provided: [Link 1](https://plugins.trac.wordpress.org/changeset/2911049/currency-switcher) and [Link 2](https://www.wordfence.com/threat-intel/vulnerabilities/id/be054481-89b4-47d8-ad06-8622edea367f?source=cve).