CVE-2023-6561: Featured Image from URL (FIFU) <= 4.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via featured image alt text
The Featured Image from URL (FIFU) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the featured image alt text in all versions up to, and including, 4.5.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-6561?
CVE-2023-6561 has a severity rating that indicates a high risk for Stored Cross-Site Scripting vulnerabilities, which can lead to significant security issues.
How do I fix CVE-2023-6561?
To fix CVE-2023-6561, update the Featured Image from URL plugin to the latest version, at least 4.5.4 or higher.
Who is affected by CVE-2023-6561?
Authenticated users with contributor or higher roles in WordPress are affected by CVE-2023-6561 if they can manipulate the featured image alt text.
What versions are affected by CVE-2023-6561?
All versions of the Featured Image from URL plugin up to and including 4.5.3 are affected by CVE-2023-6561.
What type of vulnerability is CVE-2023-6561?
CVE-2023-6561 is a Stored Cross-Site Scripting vulnerability resulting from insufficient input sanitization and output escaping.