CVE-2023-4648: WP Customer Reviews <= 3.6.6 - Authenticated (Administrator+) Stored Cross-Site Scripting
The WP Customer Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 3.6.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfilteredhtml has been disabled.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2023-4648?
CVE-2023-4648 is a vulnerability found in the WP Customer Reviews plugin for WordPress.
What is the severity of CVE-2023-4648?
CVE-2023-4648 has a severity rating of medium (4.4).
How does CVE-2023-4648 affect the WP Customer Reviews plugin?
CVE-2023-4648 affects versions up to and including 3.6.6 of the WP Customer Reviews plugin.
What is the CWE classification of CVE-2023-4648?
CVE-2023-4648 is classified under CWE-79, which is the Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability.
How can CVE-2023-4648 be fixed?
To fix CVE-2023-4648, users should update the WP Customer Reviews plugin to version 3.6.7 or later.