WordPress Plugin Vulnerabilities

Aparat <= 1.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

Description

The Aparat plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.7.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Affects Plugins

Plugin icon
aparat
No known fix

References

CVE
CVE-2023-48770
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/e6d14dd6-ff1c-475b-8cff-efc7736124b4

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.4 (medium)

Miscellaneous

Original Researcher
Rafshanzani Suhada
Verified
No
WPVDB ID
4c74d181-0a16-4f2a-ba42-53b8ea1d8905

Timeline

Publicly Published
2023-11-28 (about 2 years ago)
Added
2023-12-08 (about 2 years ago)
Last Updated
2024-01-22 (about 2 years ago)

Other

Published
Title
Published
2025-10-02
Title
Epic Bootstrap Buttons <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via icol Parameter
Published
2023-01-25
Title
Easy Social Box < 4.1.3 - Contributor+ Stored XSS via Shortcode
Published
2024-09-30
Title
ElementInvader Addons for Elementor < 1.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2024-08-07
Title
WP Table Builder – WordPress Table Plugin < 1.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2025-07-03
Title
Portfolio for Elementor & Image Gallery | PowerFolio < 3.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom JS