WordPress Plugin Vulnerabilities

Dovetail <= 1.2.13 - Admin+ Stored Cross-Site Scripting

Description

The plugin does not sanitize and escape some fields in the plugin settings, which could allow high-privilege users such as an administrator to inject arbitrary web scripts even when the unfiltered_html capability is disallowed (for example in a multisite setup).

Affects Plugins

Plugin icon
dovetail
No known fix

References

CVE
CVE-2023-25984
URL
https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/dovetail/dovetail-1213-authenticated-administrator-stored-cross-site-scripting

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
5.9 (medium)

Miscellaneous

Original Researcher
Ullash Raj
Verified
Yes
WPVDB ID
95f7dd09-57f0-42bd-8417-2c21af88e47e

Timeline

Publicly Published
2023-07-13 (about 2 years ago)
Added
2023-08-09 (about 2 years ago)
Last Updated
2023-08-09 (about 2 years ago)

Other

Published
Title
Published
2024-10-31
Title
Genoo < 6.0.13 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2025-11-03
Title
Reuse Builder <= 1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Published
2015-08-10
Title
EZP Coming Soon Page < 1.0.1 - Authenticated Cross-Site Scripting (XSS)
Published
2024-09-04
Title
Share This Image < 2.03 - Authenticated (Contributor+) Stored Cross-Site Scripting via STI Buttons Shortcode
Published
2025-11-10
Title
Skip to Timestamp <= 1.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode