CVE-2023-5668: WhatsApp Share Button <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
The WhatsApp Share Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'whatsapp' shortcode in all versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2023-5668?
CVE-2023-5668 is a vulnerability in the WhatsApp Share Button plugin for WordPress that allows for Stored Cross-Site Scripting (XSS) attacks.
What is the severity of CVE-2023-5668?
The severity of CVE-2023-5668 is medium with a CVSS score of 6.4.
How does the vulnerability in the WhatsApp Share Button plugin occur?
The vulnerability in the WhatsApp Share Button plugin occurs due to insufficient input sanitization and output escaping on user supplied attributes.
Which versions of the WhatsApp Share Button plugin are affected by CVE-2023-5668?
All versions up to and including 1.0.1 of the WhatsApp Share Button plugin for WordPress are affected by CVE-2023-5668.
How can I fix CVE-2023-5668?
To fix CVE-2023-5668, it is recommended to update the WhatsApp Share Button plugin to a version that has addressed the vulnerability.