CVE-2023-6486: Spectra – WordPress Gutenberg Blocks <= 2.10.3 - Authenticated(Contributor+) Cross-Site Scripting via Custom CSS
Published Apr 9, 2024
·Updated
The Spectra – WordPress Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custom CSS metabox in all versions up to and including 2.10.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
3 affected components
Brainstormforce Spectra Wordpress<2.10.4
Spectra WordPress Gutenberg Blocks<=2.10.3
WordPress WordPress<=2.10.3
Remediation
Event History
Apr 9, 2024
CVE Published
via MITRE·06:59 PM
Data Sourced
via MITRE·06:59 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·07:15 PM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
Can unprivileged users exploit CVE-2023-6486?
No, CVE-2023-6486 can only be exploited by authenticated attackers with access to the WordPress dashboard.