CVE-2023-5109

Summary

CVE-2023-5109 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the WP Mailto Links – Protect Email Addresses plugin for WordPress. The issue lies in the 'wpml_mailto' shortcode, which fails to properly sanitize and escape user-supplied attributes. Consequently, authenticated attackers with contributor-level access or higher can inject malicious scripts into pages. These scripts will be executed whenever an end-user accesses the manipulated page. This vulnerability was partially addressed in version 3.1.3 and fully mitigated in the subsequent update, version 3.1.4.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.