CVE-2023-6884: Plugin for Google Reviews <= 3.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode

Q: What is the severity of CVE-2023-6884?

CVE-2023-6884 is classified as a high severity vulnerability.

Q: How do I fix CVE-2023-6884?

To fix CVE-2023-6884, you should update the Richplugins Plugin for Google Reviews to version 3.2 or later.

Q: What causes the vulnerability CVE-2023-6884?

CVE-2023-6884 is caused by insufficient input sanitization and output escaping on the 'place_id' attribute in the plugin's shortcode.

Q: Who is affected by CVE-2023-6884?

CVE-2023-6884 affects all authenticated users with contributor level permissions on WordPress sites using the plugin version up to 3.1.

Q: What type of vulnerability is CVE-2023-6884?

CVE-2023-6884 is a stored cross-site scripting (XSS) vulnerability.

Published Feb 5, 2024

Updated

This plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode in all versions up to, and including, 3.1 due to insufficient input sanitization and output escaping on the 'placeid' attribute. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Affected Software

1 affected component

RichPlugins Plugin For Google Reviews Wordpress<=3.1

Remediation

Patch Available

https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3018964%40widget-google-reviews&new=3018964%40widget-google-reviews&sfp_email=&sfph_mail=

Event History

Feb 5, 2024

CVE Published

via MITRE·09:21 PM

Data Sourced

via MITRE·09:21 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·10:15 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2023-6884?

CVE-2023-6884 is classified as a high severity vulnerability.

How do I fix CVE-2023-6884?