CVE-2023-2584 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the PixelYourSite plugin for WordPress, specifically versions up to 9.3.6 (9.6.1 for the Pro version). This flaw, stemming from insufficient input sanitization and output escaping in admin settings, allows authenticated administrators to inject malicious web scripts into pages. The vulnerability is rated Medium severity (CVSS 4.8) due to its requirement for high privileges (administrator access) and user interaction (accessing an injected page), with potential for limited confidentiality and integrity impact. While the vulnerability is not listed on the KEV catalog and has no known public exploits or significant community discussion, it is important for affected multi-site installations or those with unfiltered_html disabled to update the plugin.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 9.3.6CPE matchmatch criteria | cpe:2.3:a:pixelyoursite:pixelyoursite:*:*:*:*:*:wordpress:*:* | ||
<= 9.6.1CPE matchmatch criteria | cpe:2.3:a:pixelyoursite:pixelyoursite_pro:*:*:*:*:*:wordpress:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.