WordPress Plugin Vulnerabilities

Annual Archive <= 1.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

Description

The Annual Archive plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.6.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Affects Plugins

Plugin icon
anual-archive
No known fix

References

CVE
CVE-2023-49847
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/20199c88-1800-4d18-a0ee-0219be77b429

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.4 (medium)

Miscellaneous

Original Researcher
Ngô Thiên An (ancorn_)
Verified
No
WPVDB ID
96c8b2d4-9dfd-409a-a83c-a7148fb69c58

Timeline

Publicly Published
2023-12-06 (about 2 years ago)
Added
2023-12-10 (about 2 years ago)
Last Updated
2024-01-22 (about 2 years ago)

Other

Published
Title
Published
2025-09-08
Title
Easy Woocommerce Customizer <= 1.0.2 - Reflected Cross-Site Scripting
Published
2024-09-09
Title
Forminator Forms – Contact Form, Payment Form & Custom Form Builder < 1.34.1 - Reflected Cross-Site Scripting
Published
2023-12-11
Title
WP TripAdvisor Review Slider < 11.9 - Admin+ Stored XSS
Published
2024-12-13
Title
Post Carousel & Slider < 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2023-11-20
Title
Drop Shadow Boxes < 1.7.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode