CVE-2023-4022: Herd Effects < 5.2.3 - Admin+ Stored XSS
The Herd Effects WordPress plugin before 5.2.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed (for example in multisite setup)
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID of the Herd Effects WordPress plugin?
The vulnerability ID of the Herd Effects WordPress plugin is CVE-2023-4022.
What is the severity of CVE-2023-4022?
The severity of CVE-2023-4022 is medium with a severity value of 4.8.
How does the Herd Effects WordPress plugin vulnerability allow for Stored Cross-Site Scripting attacks?
The vulnerability in the Herd Effects WordPress plugin allows high privilege users, such as admin, to perform Stored Cross-Site Scripting attacks by not sanitizing and escaping some of its settings.
Can the Stored Cross-Site Scripting attacks occur even when the unfiltered_html capability is disallowed?
Yes, the Stored Cross-Site Scripting attacks can occur even when the unfiltered_html capability is disallowed, such as in a multisite setup.
How can I fix the Herd Effects WordPress plugin vulnerability?
To fix the Herd Effects WordPress plugin vulnerability, update to version 5.2.3 or above.