WordPress Plugin Vulnerabilities

ConvertBox Auto Embed WordPress < 1.0.20 - Contributor+ Stored Cross-Site Scripting

Description

The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.

Affects Plugins

Plugin icon
convertbox-auto-embed
Fixed in 1.0.20

References

CVE
CVE-2023-23664

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.8 (medium)

Miscellaneous

Original Researcher
Lana Codes
Verified
No
WPVDB ID
f05e4287-605b-4c67-9977-e61cdc53d5d0

Timeline

Publicly Published
2023-03-20 (about 3 years ago)
Added
2023-05-09 (about 3 years ago)
Last Updated
2023-05-09 (about 3 years ago)

Other

Published
Title
Published
2024-03-29
Title
Ultimate Addons for Beaver Builder – Lite < 1.5.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget
Published
2024-10-31
Title
GDReseller <= 1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2025-11-10
Title
Eventbee Ticketing Widget <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2024-05-29
Title
WP To Do <= 1.3.0 - Authenticated (Admin+) Stored Cross-Site Scripting via Settings
Published
2023-10-18
Title
Internal Link Building <= 1.2.3 - Admin+ Stored XSS