CVE-2023-2606

Summary

CVE-2023-2606 is a vulnerability affecting the WP Brutal AI WordPress plugin before version 2.06. This issue permits high privilege users, including administrators, to execute Stored Cross-Site Scripting (XSS) attacks. The vulnerability arises from the plugin's failure to sanitize and escape certain settings. In multisite setups, the unfiltered_html capability is often disallowed to prevent such attacks, but this vulnerability bypasses that protection.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.