CVE-2023-3169

CVE-2023-3169 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the tagDiv Composer WordPress plugin versions prior to 4.2, commonly used with Newspaper and Newsmag themes. The flaw stems from a lack of authorization in a REST route and insufficient input validation and escaping, allowing unauthenticated attackers to inject malicious scripts. Rated as Medium severity (CVSS 6.1), this vulnerability can be exploited remotely with low attack complexity, requiring user interaction. A successful attack could lead to client-side compromise, information disclosure, or defacement of affected websites. This vulnerability is actively being exploited in the wild, notably by the Balada Injector attacks, impacting thousands of WordPress sites. While no Metasploit or ExploitDB modules exist, Nuclei templates are available, and there is significant community discussion and media coverage surrounding its exploitation.