CVE-2023-49833 WordPress Spectra Plugin <= 2.7.9 is vulnerable to Cross Site Scripting (XSS)

What is CVE-2023-49833?

CVE-2023-49833 is a medium-severity cross-site scripting vulnerability in Brainstorm Force Spectra – WordPress Gutenberg Blocks, published on 14 Dec 2023. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Spectra – WordPress Gutenberg Blocks allows Stored XSS.This issue affects Spectra – WordPress Gutenberg Blocks: from n/a through 2.7.9.

Weakness: CWE-79

Which versions are affected by CVE-2023-49833?

It affects 1 product.

Products include Brainstormforce Spectra.

How do I fix CVE-2023-49833?

No fix has been published for CVE-2023-49833 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2023-49833 being exploited?

There is no known exploitation of CVE-2023-49833 in the wild and no public exploit code.

Other vulnerabilities in Brainstorm Force Spectra – WordPress Gutenberg Blocks

• CVE-2023-36679 WordPress Spectra plugin <= 2.6.6 - Server Side Request Forgery (SSRF) vulnerability High 7.1
• CVE-2024-7590 WordPress Spectra plugin<= 2.14.1 - Cross Site Scripting (XSS) vulnerability Medium 6.5
• CVE-2024-10484 Cross-site scripting in Spectra Gutenberg Blocks – Website Builder for the Block Editor Medium 6.4
• CVE-2024-4366 Spectra – WordPress Gutenberg Blocks <= 2.13.0 - Authenticated (Author+) Stored Cross-Site Scripting Medium 6.4
• CVE-2024-1814 Cross-site scripting in Spectra Gutenberg Blocks – Website Builder for the Block Editor Medium 6.4

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-c6px-7rm7-c5xr.