CVE-2023-5661: XSS
First published: Tue Nov 07 2023(Updated: )
The Social Feed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'socialfeed' shortcode in all versions up to, and including, 1.5.4.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with author-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| <1.5.4.6 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2023-5661.
What is the severity level of CVE-2023-5661?
The severity level of CVE-2023-5661 is medium, with a score of 6.4.
What is the affected software by CVE-2023-5661?
The affected software by CVE-2023-5661 is the Social Feed plugin for WordPress up to version 1.5.4.6.
What is the CWE ID associated with CVE-2023-5661?
The CWE ID associated with CVE-2023-5661 is CWE-79.
How can I fix the vulnerability in the Social Feed plugin for WordPress?
To fix the vulnerability in the Social Feed plugin for WordPress, update to the latest version of the plugin.
- agent/type
- agent/references
- agent/first-publish-date
- agent/severity
- agent/author
- agent/weakness
- collector/epss-latest
- source/FIRST
- agent/epss
- collector/mitre-cve
- source/MITRE
- agent/description
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/softwarecombine
- agent/event
- agent/tags
- agent/source
- vendor/web-settler
- canonical/web-settler social feed