Vulnerability — CVE-2023-5135

CVE-2023-5135

Reference to the description:: https://nvd.nist.gov/vuln/detail/CVE-2023-5135
Description:: The Simple Cloudflare Turnstile plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'gravity-simple-turnstile' shortcode in versions up to, and including, 1.23.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Last updated date:: 10/02/2023

Type:: exploit
Confidence:: HIGH
Date of publishing:: 10/02/2023
Reference url to background: https://plugins.trac.wordpress.org/browser/simple-cloudflare-turnstile/tags/1.23.0/inc/integrations/forms/gravity-forms.php#L14

Type:: exploit
Confidence:: HIGH
Date of publishing:: 10/02/2023
Reference url to background: https://plugins.trac.wordpress.org/browser/simple-cloudflare-turnstile/tags/1.23.0/inc/integrations/forms/gravity-forms.php#L23

Type:: exploit
Confidence:: HIGH
Date of publishing:: 10/02/2023
Reference url to background: https://plugins.trac.wordpress.org/browser/simple-cloudflare-turnstile/tags/1.23.0/simple-cloudflare-turnstile.php#L72