CVE-2023-6488

Summary

CVE-2023-6488 is a stored cross-site scripting (XSS) vulnerability affecting the Shortcodes Ultimate plugin for WordPress, specifically the 'su\_button', 'su\_members', and 'su\_tabs' shortcodes in versions up to 7.0.0. The issue stems from insufficient input sanitization and output escaping on user-supplied attributes, granting attackers with contributor-level access or higher the ability to inject malicious web scripts. These scripts will execute whenever a user accesses an injected page, posing a significant security risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.