CVE-2023-6923: Matomo <= 4.15.3 - Reflected Cross-Site Scripting via idsite
The Matomo Analytics – Ethical Stats. Powerful Insights. plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the idsite parameter in all versions up to, and including, 4.15.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-6923?
CVE-2023-6923 has a medium severity rating due to the potential for unauthenticated users to exploit the reflected cross-site scripting vulnerability.
How do I fix CVE-2023-6923?
To fix CVE-2023-6923, update the Matomo Analytics plugin to version 4.15.4 or later to ensure input sanitization and output escaping are properly implemented.
What versions are affected by CVE-2023-6923?
CVE-2023-6923 affects all versions of the Matomo Analytics plugin up to and including 4.15.3.
Can CVE-2023-6923 be exploited remotely?
Yes, CVE-2023-6923 can be exploited remotely by unauthenticated attackers due to the reflected cross-site scripting vulnerability.
What are the consequences of exploiting CVE-2023-6923?
Exploiting CVE-2023-6923 could allow attackers to execute arbitrary JavaScript code in the context of a user’s session, leading to potential data theft or manipulation.