CVE-2023-2023

Deeper analysis

The Custom 404 Pro WordPress plugin before version 3.7.3 is affected by a reflected cross-site scripting vulnerability (CWE-79). The root cause is insufficient escaping of certain URLs prior to their inclusion in HTML attributes, which allows attacker-controlled input to be rendered in the page context. The issue carries a CVSS 3.1 score of 6.1 with a network attack vector, low complexity, no required privileges, and required user interaction.

An unauthenticated remote attacker can craft a malicious URL that, when visited by a victim, triggers script execution under the affected site’s origin. Successful exploitation yields limited impacts on confidentiality and integrity while changing scope, enabling actions such as session token theft or limited site-content manipulation within the victim’s browser.

The referenced WPScan advisory identifies the flaw in versions prior to 3.7.3 and indicates that updating the plugin to 3.7.3 or later resolves the input-handling deficiency. The associated EPSS score has reached a peak of 0.8310 with a current value of 0.7756, indicating sustained exploitation interest following disclosure.