WordPress Plugin Vulnerabilities

Disqus Conditional Load < 11.1.2 - Admin+ Stored Cross-Site Scripting

Description

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

Affects Plugins

Plugin icon
disqus-conditional-load
Fixed in 11.1.2

References

CVE
CVE-2023-23732

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
3.5 (low)

Miscellaneous

Original Researcher
yuyudhn
Verified
No
WPVDB ID
63b5492d-b7bd-442f-9f51-0f476869870a

Timeline

Publicly Published
2023-03-21 (about 3 years ago)
Added
2023-05-09 (about 2 years ago)
Last Updated
2023-06-27 (about 2 years ago)

Other

Published
Title
Published
2016-02-22
Title
All In One WP Security And Firewall < 4.0.5 - XSS
Published
2020-01-15
Title
YOP Poll < 6.1.2 - Reflected Cross-Site Scripting
Published
2025-01-06
Title
Candifly <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2024-02-21
Title
Elementor Addon Elements < 1.13 - Authenticated(Contributor+) Stored Cross-Site Scripting via Modal Popup effet
Published
2022-10-10
Title
Rock Convert < 2.11.0 - Admin+ Stored Cross-Site Scripting