CVE-2023-2337
CVSS 3.1 Score 7.8 of 10 (high)
Details
Published Jun 5, 2023
Updated: Jan 8, 2025
CWE ID 787
CWE ID 122
Summary
CVE-2023-2337 is a Reflected Cross-Site Scripting (XSS) vulnerability affecting the ConvertKit WordPress plugin before version 2.2.1. Malicious scripts can be injected into parameter inputs, which are then directly rendered back in an HTML attribute without proper escaping. This issue poses a serious threat as it can be exploited against high-privilege users, such as administrators, to gain unauthorized access or perform malicious actions on vulnerable websites.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.