Unauthenticated Stored XSS in Akita Website Builder for WordPress (CVE-2023-4448)

Vulnerability Overview Vulnerability Name: Akita Website Builder For WordPress & WooCommerce <= 7.20.1 - Unauthenticated (Subscriber) Stored Cross-Site Scripting via Author (Shortcode) User Profile Field Vulnerability Type: Stored Cross-Site Scripting (XSS) Vulnerability Description: In version 7.20.1 and earlier versions of the Akita Website Builder plugin, there exists an unauthenticated stored cross-site scripting vulnerability. Attackers can execute malicious code when users visit relevant pages by injecting malicious scripts into the Author (Shortcode) user profile field. Affected Scope Affected Versions: Akita Website Builder For WordPress & WooCommerce <= 7.20.1 Severity Level: Medium CVSS Score: 6.1 CVE ID: CVE-2023-4448 Remediation Remediation Recommendation: Upgrade to the latest version of Akita Website Builder For WordPress & WooCommerce to fix this vulnerability. Temporary Mitigation: If an immediate upgrade is not possible, it is recommended to restrict access to the Author (Shortcode) user profile field and regularly review and clean user input to prevent the injection of malicious scripts. POC Code Additional Information Release Date: 2023-09-18 Update Date: 2023-09-18 Reference Link: Akita Website Builder For WordPress & WooCommerce Summary Version 7.20.1 and earlier of Akita Website Builder For WordPress & WooCommerce contains an unauthenticated stored cross-site scripting vulnerability. Attackers can execute malicious code by injecting malicious scripts into the Author (Shortcode) user profile field. It is recommended to upgrade to the latest version to fix this vulnerability, or to apply temporary measures such as restricting access permissions and sanitizing user input.

Goal Reached Thanks to every supporter — we hit 100%!

Unauthenticated Stored XSS in Akita Website Builder for WordPress (CVE-2023-4448)

More from this source