WordPress Plugin Vulnerabilities

Dashboard Widgets Suite < 3.2.2 - Admin+ Stored XSS

Description

The plugin does not sanitise and escape some of its parameters, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

Affects Plugins

Plugin icon
dashboard-widgets-suite
Fixed in 3.2.2

References

CVE
CVE-2023-26517

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
3.5 (low)

Miscellaneous

Original Researcher
Rio Darmawan
Verified
No
WPVDB ID
196e645d-cc2b-4722-8482-daf46c84fc92

Timeline

Publicly Published
2023-02-27 (about 3 years ago)
Added
2023-05-08 (about 3 years ago)
Last Updated
2023-05-08 (about 3 years ago)

Other

Published
Title
Published
2026-01-07
Title
Gutenverse Form < 2.4.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
Published
2024-02-21
Title
Elementor Addon Elements < 1.13 - Contributor+ Stored XSS
Published
2025-04-10
Title
DN Shipping by Weight for WooCommerce < 1.2.1 - Reflected Cross-Site Scripting
Published
2025-03-28
Title
FormLift for Infusionsoft Web Forms < 7.5.20 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2025-02-17
Title
s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions < 250214 - Reflected Cross-Site Scripting