Skip to main content

Improper Neutralization of Alternate XSS Syntax

CVE-2023-6446

Medium
4.4/10

Summary

The Calculated Fields Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.2.40 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

  • HIGH
  • NETWORK
  • LOW
  • CHANGED
  • NONE
  • HIGH
  • LOW
  • NONE

CWE-87 - Improper Neutralization of Alternate XSS Syntax

The software does not neutralize or incorrectly neutralizes user-controlled input for alternate script syntax.

References

Advisory Timeline

  • Published