CVE-2023-54351: WordPress Sonaar Music Plugin 4.7 Stored XSS via Comments
WordPress Sonaar Music Plugin 4.7 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts through the comment functionality. Attackers can submit JavaScript payloads in the comment parameter to wp-comments-post.php which are stored and executed in the browsers of users viewing the affected playlist pages.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
wordpress/sonaar-music-pluginfrom your environment.Uninstall or deactivate the Sonaar Music Plugin (v4.7) if it is not required to eliminate the vulnerable code path accepting comment input.
- Configuration
Disable or close comments on the WordPress site to prevent unauthenticated comment submissions to wp-comments-post.php.
WordPress comments_enabled = false - Configuration
Enable comment moderation (require admin approval) so submitted comments are not published automatically.
WordPress comment_moderation = true - Compensating control
Apply a web application firewall (WAF) rule or other input-filtering control to block or sanitize script payloads in the comment parameter sent to wp-comments-post.php, or restrict access to wp-comments-post.php to authenticated/trusted IPs.
- Operational
Search the site database (e.g., wp_comments) and affected playlist pages for stored comments containing injected JavaScript; remove or sanitize any malicious entries and verify pages no longer execute the payloads.
Event History
Frequently Asked Questions
What is the severity of CVE-2023-54351?
CVE-2023-54351 has a severity rating of high with a score of 7.2.
How do I fix CVE-2023-54351?
To fix CVE-2023-54351, update the Sonaar Music Plugin to the latest version that addresses the stored XSS vulnerability.
What can attackers do with CVE-2023-54351?
Attackers can exploit CVE-2023-54351 to inject and execute malicious JavaScript through the comment functionality.
Which version of the Sonaar Music Plugin is affected by CVE-2023-54351?
CVE-2023-54351 affects version 4.7 of the Sonaar Music Plugin.
Is authentication required to exploit CVE-2023-54351?
No, CVE-2023-54351 can be exploited by unauthenticated attackers.