WordPress Plugin Vulnerabilities

Buzzsprout Podcasting < 1.8.5 - Contributor+ Stored Cross-Site Scripting

Description

The plugin does not adequately sanitize and escape user-supplied attributes in the 'buzzsprout' shortcode, which leads to a potential Stored Cross-Site Scripting vulnerability. This issue can result in the injection of arbitrary web scripts into pages, which are then executed when a user accesses the injected page.

Affects Plugins

Plugin icon
buzzsprout-podcasting
Fixed in 1.8.5

References

CVE
CVE-2023-5335
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/be7f8b73-801d-46e8-81c1-8bb0bb576700

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.4 (medium)

Miscellaneous

Original Researcher
Lana Codes
Verified
No
WPVDB ID
21ece92a-3d9f-43e3-b551-780de4e60838

Timeline

Publicly Published
2023-10-29 (about 2 years ago)
Added
2023-11-03 (about 2 years ago)
Last Updated
2023-11-08 (about 2 years ago)

Other

Published
Title
Published
2024-07-11
Title
WP Total Branding < 1.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via title Parameter
Published
2025-06-19
Title
PDPA Consent for Thailand <= 1.1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
Published
2016-05-11
Title
Tera Charts 1.0 - Unauthenticated Cross-Site Scripting (XSS)
Published
2024-03-18
Title
WPB Show Core < 2.7 - Reflected XSS
Published
2025-03-18
Title
Stencies <= 0.58 - Reflected Cross-Site Scripting