CVE-2023-4772: Newsletter <= 7.8.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
The Newsletter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'newsletterform' shortcode in versions up to, and including, 7.8.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2023-4772?
CVE-2023-4772 is a vulnerability in the Newsletter plugin for WordPress that allows authenticated attackers to execute stored cross-site scripting attacks.
How does CVE-2023-4772 occur?
CVE-2023-4772 occurs due to insufficient input sanitization and output escaping in the 'newsletter_form' shortcode of the Newsletter plugin for WordPress.
What is the severity of CVE-2023-4772?
The severity of CVE-2023-4772 is medium with a CVSS score of 5.4.
What is the affected software?
The affected software is the Newsletter plugin for WordPress versions up to, and including, 7.8.9.
How can CVE-2023-4772 be fixed?
CVE-2023-4772 can be fixed by updating the Newsletter plugin to a version higher than 7.8.9.