CVE-2023-50368 WordPress Shortcodes and extra features for Phlox theme Plugin <= 2.15.2 is vulnerable to Cross Site Scripting (XSS)

What is CVE-2023-50368?

CVE-2023-50368 is a medium-severity cross-site scripting vulnerability in Averta Shortcodes and extra features for Phlox theme, published on 14 Dec 2023. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Averta Shortcodes and extra features for Phlox theme allows Stored XSS.This issue affects Shortcodes and extra features for Phlox theme: from n/a through 2.15.2.

Weakness: CWE-79

Which versions are affected by CVE-2023-50368?

It affects 1 product.

Products include Averta Shortcodes and Extra Features for Phlox Theme.

How do I fix CVE-2023-50368?

No fix has been published for CVE-2023-50368 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2023-50368 being exploited?

There is no known exploitation of CVE-2023-50368 in the wild and no public exploit code.

Other vulnerabilities in Averta Shortcodes and extra features for Phlox theme

• CVE-2022-3359 Shortcodes and extra features for Phlox theme < 2.10.7 - PHP Objection Injection High 8.8
• CVE-2023-37888 WordPress Phlox Core Elements plugin <= 2.14.0 - Unauthenticated Local File Inclusion vulnerability High 7.6
• CVE-2023-7064 Deserialization in Shortcodes and extra features for Phlox theme High 7.5
• CVE-2024-12588 Cross-site scripting in Shortcodes and extra features for Phlox theme Medium 6.4
• CVE-2024-9545 Cross-site scripting in Shortcodes and extra features for Phlox theme Medium 6.4

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-ffq3-5jq8-m5f3.