CVE-2023-6624: Import and export users and customers <= 1.24.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
The Import and export users and customers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 1.24.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-6624?
CVE-2023-6624 has a severity rating that indicates it poses a significant risk due to potential Stored Cross-Site Scripting vulnerabilities.
How do I fix CVE-2023-6624?
To fix CVE-2023-6624, update the Import and Export Users and Customers plugin to the latest version beyond 1.24.3 which includes security patches.
What versions are affected by CVE-2023-6624?
CVE-2023-6624 affects all versions of the Import and Export Users and Customers plugin up to and including 1.24.3.
What type of vulnerability is CVE-2023-6624?
CVE-2023-6624 is classified as a Stored Cross-Site Scripting vulnerability that arises from insufficient input sanitization and output escaping.
Is it safe to use the Import and Export Users and Customers plugin with CVE-2023-6624?
Using the Import and Export Users and Customers plugin with CVE-2023-6624 is not safe without applying the necessary security updates.