CVE-2023-6809

CVE-2023-6809 describes a Stored Cross-Site Scripting (XSS) vulnerability in the Custom fields shortcode plugin for WordPress, affecting all versions up to and including 0.1. This flaw stems from insufficient input sanitization and output escaping of user-supplied custom post meta values. Authenticated attackers with contributor-level permissions or higher can inject malicious web scripts into pages, which then execute when other users view those compromised pages. The vulnerability has a CVSS score of 5.4 (Medium), indicating a moderate severity. It requires user interaction (UI:R) and low privileges (PR:L) to exploit, but can lead to limited confidentiality and integrity impacts (C:L, I:L). There is currently no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal, aligning with the typical lack of attention for the vast majority of reported vulnerabilities.