CVE-2023-2735: Groundhogg <= 2.7.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
The Groundhogg plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ghform' shortcode in versions up to, and including, 2.7.9.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Please note this only works with legacy contact forms.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-2735?
CVE-2023-2735 is a vulnerability in the Groundhogg plugin for WordPress that allows for Stored Cross-Site Scripting (XSS) attacks.
How does CVE-2023-2735 affect the Groundhogg plugin for WordPress?
CVE-2023-2735 affects the Groundhogg plugin for WordPress versions up to and including 2.7.9.8.
What is the severity of CVE-2023-2735?
CVE-2023-2735 has a severity rating of medium, with a severity value of 5.4.
How can authenticated attackers exploit CVE-2023-2735?
Authenticated attackers can exploit CVE-2023-2735 through the 'gh_form' shortcode in the Groundhogg plugin for WordPress.
Are there any references for CVE-2023-2735?
Yes, you can find references for CVE-2023-2735 at the following links: [Link 1](https://plugins.trac.wordpress.org/browser/groundhogg/tags/2.7.9.8/includes/form/form.php#L187), [Link 2](https://plugins.trac.wordpress.org/browser/groundhogg/tags/2.7.9.8/includes/shortcodes.php#L51), [Link 3](https://plugins.trac.wordpress.org/changeset/2914493/groundhogg/trunk/includes/better-meta-compat.php).