The Custom Permalinks plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.6.0 due to insufficient input sanitization and output escaping on tag names. This allows authenticated users, with editor-level permissions or greater to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page, even when 'unfiltered_html' has been disabled.
References
Configurations
History
27 Sep 2024, 01:01
Type | Values Removed | Values Added |
---|---|---|
CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.4 |
References | () https://github.com/samiahmedsiddiqui/custom-permalinks/pull/96 - Issue Tracking, Patch | |
References | () https://plugins.trac.wordpress.org/changeset/3138206/custom-permalinks/trunk/admin/class-custom-permalinks-post-types-table.php - Patch | |
References | () https://plugins.trac.wordpress.org/changeset/3138206/custom-permalinks/trunk/admin/class-custom-permalinks-taxonomies-table.php - Patch | |
References | () https://wordpress.org/plugins/custom-permalinks/ - Product | |
References | () https://www.wordfence.com/threat-intel/vulnerabilities/id/97f8549a-292d-4a6d-8ec0-550467e5cf0f?source=cve - Third Party Advisory | |
CPE | cpe:2.3:a:samiahmedsiddiqui:custom_permalinks:*:*:*:*:*:wordpress:*:* | |
First Time |
Samiahmedsiddiqui custom Permalinks
Samiahmedsiddiqui |
26 Aug 2024, 12:47
Type | Values Removed | Values Added |
---|---|---|
Summary |
|
24 Aug 2024, 02:15
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2024-08-24 02:15
Updated : 2024-09-27 01:01
NVD link : CVE-2023-0926
Mitre link : CVE-2023-0926
CVE.ORG link : CVE-2023-0926
JSON object : View
Products Affected
samiahmedsiddiqui
- custom_permalinks
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')