CVE-2023-2964
Simple Iframe < 1.2.0 - Contributor+ Stored XSS
- State
- Published
- Severity
- 5.4 Medium
- Published
- Jul 10, 2023
- Updated
- Apr 23, 2025
- Reserved
- May 29, 2023
Description
The Simple Iframe WordPress plugin before 1.2.0 does not properly validate one of its WordPress block attribute's content, which may allow users whose role is at least that of a contributor to conduct Stored Cross-Site Scripting attacks.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 5.4 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N | CISA-ADP |
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
Simple IframeUnknown |
|
References
- https://wpscan.com/vulnerability/97aac334-5323-41bb-90f0-d180bcc9162fexploitvdb-entrytechnical-description
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.