CVE-2023-6561

Summary

CVE-2023-6561 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the Featured Image from URL (FIFU) plugin for WordPress. This issue, present in all versions up to 4.5.3, allows authenticated attackers, with contributor-level access and above, to inject malicious scripts into the alt text of featured images. As a result, these scripts are stored in the database and executed whenever a user accesses an injected page, posing a significant security risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.