The Skype Legacy Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'skype-status' shortcode in all versions up to, and including, 3.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
References
| Link | Resource |
|---|---|
| https://www.wordfence.com/threat-intel/vulnerabilities/id/914bcc8f-fecd-450e-b2a7-0989b7a0dd4c?source=cve | Product Third Party Advisory |
| https://plugins.trac.wordpress.org/browser/skype-online-status/tags/3.1/skype-classes.php#L316 | Product |
Configurations
History
26 Oct 2023, 18:16
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-79 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.4 |
| CPE | cpe:2.3:a:ravanh:skype_legacy_buttons:*:*:*:*:*:wordpress:*:* | |
| First Time |
Ravanh
Ravanh skype Legacy Buttons |
|
| References | (MISC) https://plugins.trac.wordpress.org/browser/skype-online-status/tags/3.1/skype-classes.php#L316 - Product | |
| References | (MISC) https://www.wordfence.com/threat-intel/vulnerabilities/id/914bcc8f-fecd-450e-b2a7-0989b7a0dd4c?source=cve - Product, Third Party Advisory |
20 Oct 2023, 08:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-10-20 08:15
Updated : 2023-11-07 04:24
NVD link : CVE-2023-5615
Mitre link : CVE-2023-5615
JSON object : View
Products Affected
ravanh
- skype_legacy_buttons
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')