CVE-2023-3410: Bricks <= 1.10.1 - Authenticated (Bricks Page Builder Access+) Stored Cross-Site Scripting
The Bricks theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘customTag' attribute in versions up to, and including, 1.10.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with access to the Bricks Builder (admin-only by default), to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This becomes more of an issue when Bricks Builder access is granted to lower-privileged users.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-3410?
CVE-2023-3410 has been rated as a medium severity vulnerability due to its potential for exploitation by authenticated attackers.
How do I fix CVE-2023-3410?
To fix CVE-2023-3410, upgrade the Bricks theme to version 1.10.2 or later which addresses the stored cross-site scripting vulnerability.
Who is affected by CVE-2023-3410?
CVE-2023-3410 affects users of the Bricks theme for WordPress up to version 1.10.1.
What type of vulnerability is CVE-2023-3410?
CVE-2023-3410 is classified as a Stored Cross-Site Scripting (XSS) vulnerability.
What versions of the Bricks theme are vulnerable to CVE-2023-3410?
Versions of the Bricks theme for WordPress up to and including 1.10.1 are vulnerable to CVE-2023-3410.