CVE-2023-5110: BSK PDF Manager <= 3.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
The BSK PDF Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'bsk-pdfm-category-dropdown' shortcode in versions up to, and including, 3.4.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2023-5110?
CVE-2023-5110 is a vulnerability in the BSK PDF Manager plugin for WordPress that allows for stored cross-site scripting (XSS) attacks.
How does CVE-2023-5110 affect the BSK PDF Manager plugin?
CVE-2023-5110 affects the BSK PDF Manager plugin by allowing authenticated users to execute malicious scripts via the 'bsk-pdfm-category-dropdown' shortcode.
What is the severity of CVE-2023-5110?
The severity of CVE-2023-5110 is rated as medium with a CVSS score of 5.4.
How can the CVE-2023-5110 vulnerability be exploited?
The CVE-2023-5110 vulnerability can be exploited by authenticated users injecting malicious scripts through the 'bsk-pdfm-category-dropdown' shortcode.
How can I mitigate the CVE-2023-5110 vulnerability in the BSK PDF Manager plugin?
To mitigate the CVE-2023-5110 vulnerability, update the BSK PDF Manager plugin to version 3.4.2 or higher, which includes proper input sanitization and output escaping.