CVE-2023-3055: Page Builder by AZEXO <= 1.27.133 - Cross-Site Request Forgery to Stored Cross-Site Scripting via azh_save
The Page Builder by AZEXO plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.27.133. This is due to missing or incorrect nonce validation on the 'azhsave' function. This makes it possible for unauthenticated attackers to update the post content and inject malicious JavaScript via a forged request, granted they can trick a site administrator into performing an action such as clicking on a link.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-3055?
CVE-2023-3055 has a medium severity rating due to its potential for unauthorized content changes via Cross-Site Request Forgery.
How do I fix CVE-2023-3055?
To fix CVE-2023-3055, update the Page Builder by AZEXO plugin to version 1.27.134 or later where the nonce validation issue has been addressed.
Who is affected by CVE-2023-3055?
CVE-2023-3055 affects all WordPress sites using versions of the Page Builder by AZEXO plugin up to and including 1.27.133.
What type of vulnerability is CVE-2023-3055?
CVE-2023-3055 is classified as a Cross-Site Request Forgery vulnerability, allowing unauthorized actions without user authentication.
What actions can attackers perform due to CVE-2023-3055?
Attackers exploiting CVE-2023-3055 can update post content on affected WordPress sites without proper authorization.