CVE-2023-2600
CVSS 3.1 Score 9.8 of 10 (high)
Details
Summary
CVE-2023-2600 is a vulnerability affecting the Custom Base Terms plugin used in WordPress. Before version 1.0.3, the plugin fails to sanitize and escape certain settings, making it susceptible to Stored Cross-Site Scripting (XSS) attacks. High-privilege users, including admins, can exploit this vulnerability to inject malicious scripts into the system, bypassing the unfiltered_html capability restriction, even in multisite setups. This issue poses a significant risk and requires immediate remediation by updating to the latest plugin version or implementing additional security measures.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.