CVE-2023-6938

Summary

CVE-2023-6938 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the Oxygen Builder plugin for WordPress. This issue, present in all versions up to 4.8, allows authenticated contributors and above to inject malicious scripts into custom fields, which are then executed whenever an injected page is accessed. The root cause is insufficient input sanitization and output escaping in the plugin. A patch, in the form of an optional filter, has been implemented in version 4.8.1 of the plugin, enabling output escaping for dynamic data to mitigate this issue. (Source: CVE Details)

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.