CVE-2023-6561

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The Featured Image from URL (FIFU) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the featured image alt text in all versions up to, and including, 4.5.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Jan 11, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-65627.5JPX Fragment List (flst) box vulnerability in Kakadu 7.9 allows an attacker to exfiltrate local and remote files reachable by a server if th CVE-2023-65637.7An unconstrained memory consumption vulnerability was discovered in Keycloak. It can be triggered in environments which have millions of off CVE-2023-65646.5An issue has been discovered in GitLab EE Premium and Ultimate affecting versions 16.4.3, 16.5.3, and 16.6.1. In projects using subgroups to CVE-2023-65655.9The InfiniteWP Client plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.12.3 via CVE-2023-65666.5Business Logic Errors in GitHub repository microweber/microweber prior to 2.0.CVE-2023-65677.5The LearnPress plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order_by’ parameter in all versions up to, and includ CVE-2023-65686.1A reflected Cross-Site Scripting (XSS) vulnerability exists in the mlflow/mlflow repository, specifically within the handling of the Content CVE-2023-65698.2External Control of File Name or Path in h2oai/h2o-3 CVE-2023-65706.5Server-Side Request Forgery (SSRF) in kubeflow/kubeflow CVE-2023-65716.1Cross-site Scripting (XSS) - Reflected in kubeflow/kubeflow CVE-2023-65728.1Command Injection in GitHub repository gradio-app/gradio prior to main.CVE-2023-65735.5HPE OneView may have a missing passphrase during restore.