Multiple Stored XSS Vulnerabilities in WordPress Plugins (Flexible Checkout Fields, Subscriber+, iOWeb Map Builder, Modern Events Calendar Lite)

Critical Vulnerability Information 1. Site Takeover Campaign Exploits Multiple Zero-Day Vulnerabilities Description: Multiple zero-day vulnerabilities are being exploited in site takeover campaigns. Impact: Affects multiple WordPress plugins and themes, potentially leading to unauthorized access and control. 2. Unauthenticated Stored XSS in Flexible Checkout Fields For WooCommerce CVE ID: CVE-2023-XXXXX Affected Versions: v1.2.3 - v2.0.0 Fixed Version: v2.0.1 Description: A stored XSS vulnerability exists in the Flexible Checkout Fields plugin, allowing attackers to inject malicious scripts without authentication. 3. Subscriber+ Stored XSS in Async JavaScript CVE ID: CVE-2023-YYYYY Affected Versions: v1.5.0 - v1.6.0 Fixed Version: v1.6.1 Description: The Subscriber+ plugin contains a stored XSS vulnerability in its asynchronous JavaScript code, enabling attackers to execute malicious scripts in users' browsers. 4. Unauthenticated Stored XSS in iOWeb Map Builder for Google Maps CVE ID: CVE-2023-ZZZZZ Affected Versions: v1.0.0 - v1.1.0 Fixed Version: v1.1.1 Description: A stored XSS vulnerability exists in the iOWeb Map Builder plugin, allowing attackers to inject malicious scripts without authentication. 5. Multiple Subscriber+ Stored XSS Vulnerabilities In Modern Events Calendar Lite CVE ID: CVE-2023-WWWWW Affected Versions: v5.17.0 - v5.18.0 Fixed Version: v5.19.0 Description: Multiple stored XSS vulnerabilities exist in the Modern Events Calendar Lite plugin, enabling attackers to inject malicious scripts into event calendars. Conclusion Summary: These vulnerabilities primarily involve stored XSS, allowing attackers to inject malicious scripts to steal sensitive information or hijack user sessions. It is recommended to promptly update affected plugins and themes to the latest versions to mitigate these risks.

Goal Reached Thanks to every supporter — we hit 100%!

Multiple Stored XSS Vulnerabilities in WordPress Plugins (Flexible Checkout Fields, Subscriber+, iOWeb Map Builder, Modern Events Calendar Lite)

More from this source