CVE-2023-1080

Deeper analysis

The GN Publisher plugin for WordPress is affected by a reflected cross-site scripting vulnerability (CWE-79) in versions up to and including 1.5.5. The flaw resides in the handling of the 'tab' parameter within the settings template and stems from missing input sanitization combined with inadequate output escaping, allowing script injection into rendered pages.

Unauthenticated remote attackers can exploit the issue by crafting a malicious link that, when clicked by an authenticated user, executes arbitrary JavaScript in the victim's browser context. The attack requires user interaction and yields limited impact on confidentiality and integrity with no availability effect, consistent with its CVSS 3.1 score of 6.1.

Public references from Wordfence and the WordPress plugin repository confirm the reflected XSS vectors and indicate that the vendor addressed the root cause through improved parameter handling in subsequent releases; administrators are advised to update the plugin promptly and to validate that custom templates no longer echo unsanitized request values.

EPSS for this CVE rose from a low baseline to a peak of 0.4472 before receding to the current value of 0.1736, indicating a measurable increase in exploitation interest after public disclosure.