CVE-2023-6497
CVSS 3.1 Score 4.8 of 10 (medium)
Details
Summary
CVE-2023-6497 is a stored cross-site scripting (XSS) vulnerability affecting the WordPress Simple Shopping Cart plugin up to version 4.7.1. This issue, which only impacts multi-site installations and those with unfiltered_html disabled, allows authenticated attackers with administrator-level permissions to inject malicious scripts into automatic redirect URLs. These scripts will execute whenever a user accesses an injected page, potentially leading to serious security consequences such as data theft or unauthorized account access. The root cause of the vulnerability is insufficient input sanitization and output escaping.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions