CVE-2023-3169

Deeper analysis

The vulnerability is a stored cross-site scripting flaw in the tagDiv Composer WordPress plugin prior to version 4.2, a component used by the Newspaper and Newsmag themes from tagDiv. It arises because a REST route lacks authorization checks and fails to validate or escape certain parameters before reflecting them in output, allowing malicious input to be stored and later executed in victims' browsers. The issue carries a CVSS 3.1 score of 6.1 with network attack vector, low complexity, no required privileges, and required user interaction.

Unauthenticated remote attackers can exploit the flaw by submitting crafted requests to the affected REST endpoint, achieving persistent script execution in the context of other users who view the injected content. This can result in limited impacts to confidentiality and integrity, such as session hijacking or unauthorized actions within the WordPress site, without affecting availability.

WPScan advisories document the vulnerability and confirm that the plugin versions before 4.2 are affected, with the current EPSS score of 0.3560 and a recorded peak of 0.3926 indicating moderate but stable exploitation interest since disclosure.