CVE-2023-4308: User Submitted Posts <= 20230809 - Unauthenticated Stored Cross-Site Scripting via 'user-submitted-content'
The User Submitted Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘user-submitted-content’ parameter in versions up to, and including, 20230809 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2023-4308.
What is the severity of CVE-2023-4308?
The severity of CVE-2023-4308 is high (5.4).
How does the User Submitted Posts plugin for WordPress become vulnerable to Stored Cross-Site Scripting?
The User Submitted Posts plugin for WordPress becomes vulnerable to Stored Cross-Site Scripting through the 'user-submitted-content' parameter, due to insufficient input sanitization and output escaping.
Who is affected by CVE-2023-4308?
Users of the User Submitted Posts plugin for WordPress versions up to, and including, 20230809 are affected by CVE-2023-4308.
How can the CVE-2023-4308 vulnerability be fixed?
To fix CVE-2023-4308, upgrade to a version of the User Submitted Posts plugin for WordPress that is after 20230811.