WordPress Plugin Vulnerabilities

Add Custom Body Class <= 1.4.1 - Contributor+ Stored Cross-Site Scripting

Description

The plugin does not properly escape the add_custom_body_class parameter before outputting it to the page, allowing users with the role of contributor of higher to inject arbitrary web scripts potentially targeting higher privileged users.

Affects Plugins

Plugin icon
add-custom-body-class
No known fix

References

CVE
CVE-2023-5205
URL
https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/add-custom-body-class/add-custom-body-class-141-authenticated-contributor-stored-cross-site-scripting

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.4 (medium)

Miscellaneous

Original Researcher
Francesco Carlucci
Verified
No
WPVDB ID
a12671c8-aceb-4fff-a288-7c9395154406

Timeline

Publicly Published
2023-10-20 (about 2 years ago)
Added
2023-10-27 (about 2 years ago)
Last Updated
2023-10-27 (about 2 years ago)

Other

Published
Title
Published
2014-08-01
Title
SimpleMail 1.0.6 - Stored XSS
Published
2024-07-10
Title
WP Announcement < 2.0.9 - Authenticated (Administrator+) Stored Cross-Site Scripting
Published
2015-05-12
Title
Artificial Intelligence Theme <= 1.2.3 - DOM Cross-Site Scripting (XSS)
Published
2024-09-09
Title
Community by PeepSo – Social Network, Membership, Registration, User Profiles < 6.4.6.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
Published
2025-01-16
Title
Find Content IDs <= 1.0 - Reflected Cross-Site Scripting