WordPress Plugin Vulnerabilities

POWR < 2.2.0 - Contributor+ Stored XSS

Description

The plugin does not validate and escape some of its powr-powr-pack shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks

Affects Plugins

Plugin icon
powr-pack
Fixed in 2.2.0

References

CVE
CVE-2023-45609
CVE
CVE-2023-5741
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/c2967eae-82bb-4556-a21a-c5bb6b905c62

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
5.9 (medium)

Miscellaneous

Original Researcher
István Márton
Verified
No
WPVDB ID
ed81b52b-4932-4da5-a7ce-7bbdf8144224

Timeline

Publicly Published
2023-11-10 (about 2 years ago)
Added
2023-11-16 (about 2 years ago)
Last Updated
2024-01-09 (about 2 years ago)

Other

Published
Title
Published
2022-08-09
Title
Social Slider Feed < 2.0.7 - Admin+ Stored XSS via Feeds
Published
2026-02-04
Title
Peter's Date Countdown < 2.0.1 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']
Published
2025-07-03
Title
Easy restaurant menu manager < 2.0.2 - Authenticated (Contributot+) Stored Cross-Site Scripting via `nsc_eprm_menu_link` Shortcode
Published
2022-12-21
Title
Click to Chat < 3.18.1 - Contributor+ Stored XSS
Published
2025-12-05
Title
RevInsite <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes