CVE-2023-3051: Page Builder by AZEXO <= 1.27.133 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
The Page Builder by AZEXO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'azhpost' shortcode in versions up to, and including, 1.27.133 due to insufficient input sanitization and output escaping. This makes it possible for contributor-level attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-3051?
CVE-2023-3051 is considered a medium severity vulnerability due to the potential for stored cross-site scripting attacks.
How do I fix CVE-2023-3051?
To fix CVE-2023-3051, update the AZEXO Page Builder plugin to version 1.27.134 or later.
Who is affected by CVE-2023-3051?
CVE-2023-3051 affects users of the Page Builder by AZEXO plugin for WordPress versions up to and including 1.27.133.
What type of vulnerability is CVE-2023-3051?
CVE-2023-3051 is a stored cross-site scripting (XSS) vulnerability.
What can attackers do with CVE-2023-3051?
Attackers with contributor-level access can exploit CVE-2023-3051 to inject arbitrary web scripts into the affected site.