CVE-2023-2023
CVSS 3.1 Score 9.8 of 10 (high)
Details
Published May 30, 2023
Updated: Jan 9, 2025
CWE ID 287
Summary
CVE-2023-2023 refers to a Reflected Cross-Site Scripting (XSS) vulnerability affecting the Custom 404 Pro WordPress plugin before version 3.7.3. Maliciously crafted URLs are not properly escaped prior to being output in plugin attributes, enabling an attacker to inject and execute malicious scripts in users' browsers. This can lead to unauthorized access, data theft, or further exploitation. Users are advised to update the plugin to the latest version or remove it if no longer in use to mitigate the risk.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Affected Vendors
- Cisco Systems Inc