CVE-2023-6624: XSS
First published: Thu Jan 11 2024(Updated: )
The Import and export users and customers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 1.24.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Codection Import and Export Users and Customers | <=1.24.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3007926%40import-users-from-csv-with-meta%2Ftrunk&old=3007057%40import-users-from-csv-with-meta%2Ftrunk&sfp_email=&sfph_mail=
- https://www.wordfence.com/threat-intel/vulnerabilities/id/4731eb39-8c01-4a2b-80f7-15d8c13a19b5?source=cve
Frequently Asked Questions
What is the severity of CVE-2023-6624?
CVE-2023-6624 has a severity rating that indicates it poses a significant risk due to potential Stored Cross-Site Scripting vulnerabilities.
How do I fix CVE-2023-6624?
To fix CVE-2023-6624, update the Import and Export Users and Customers plugin to the latest version beyond 1.24.3 which includes security patches.
What versions are affected by CVE-2023-6624?
CVE-2023-6624 affects all versions of the Import and Export Users and Customers plugin up to and including 1.24.3.
What type of vulnerability is CVE-2023-6624?
CVE-2023-6624 is classified as a Stored Cross-Site Scripting vulnerability that arises from insufficient input sanitization and output escaping.
Is it safe to use the Import and Export Users and Customers plugin with CVE-2023-6624?
Using the Import and Export Users and Customers plugin with CVE-2023-6624 is not safe without applying the necessary security updates.
- agent/references
- agent/type
- agent/author
- agent/description
- agent/remedy
- collector/epss-latest
- source/FIRST
- agent/epss
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/last-modified-date
- agent/severity
- agent/first-publish-date
- agent/event
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/softwarecombine
- agent/tags
- agent/source
- vendor/codection
- canonical/codection import and export users and customers
- version/codection import and export users and customers/1.24.3