CVE-2023-3992: PostX - Gutenberg Post Grid Blocks < 3.0.6 - Reflected Cross-Site Scripting
The PostX WordPress plugin before 3.0.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-3992?
CVE-2023-3992 is a vulnerability found in the PostX WordPress plugin before version 3.0.6 that allows for Reflected Cross-Site Scripting (XSS) attacks.
What is the severity of CVE-2023-3992?
The severity of CVE-2023-3992 is medium, with a CVSS severity score of 6.1.
How does CVE-2023-3992 affect WordPress websites?
CVE-2023-3992 affects WordPress websites that have the PostX plugin installed and have a version prior to 3.0.6.
How can the CVE-2023-3992 vulnerability be exploited?
The CVE-2023-3992 vulnerability can be exploited by injecting malicious code through a parameter and tricking a high privilege user, such as an admin, into clicking on a specially crafted link.
How can I fix the CVE-2023-3992 vulnerability?
To fix the CVE-2023-3992 vulnerability, update the PostX WordPress plugin to version 3.0.6 or later, which includes sanitization and proper escaping of parameters.