The TaxoPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Suggest Terms Title field in versions up to, and including, 3.6.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with Editor+ permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
References
Configurations
History
07 Nov 2023, 04:12
Type | Values Removed | Values Added |
---|---|---|
CWE |
Information
Published : 2023-04-19 10:15
Updated : 2024-02-28 20:13
NVD link : CVE-2023-2168
Mitre link : CVE-2023-2168
CVE.ORG link : CVE-2023-2168
JSON object : View
Products Affected
taxopress
- taxopress
CWE
No CWE.