CVE-2023-24378 MEDIUM

CVE-2023-24378: WordPress Glossary Plugin <= 2.1.27 is vulnerable to Cross Site Scripting (XSS)

Vendor Codeat

Product Glossary

Weakness CWE-79 · XSS

Published April 6, 2023

Last update April 28, 2026

View on NVD All CVEs

CVSS base score

6.5/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction Required

Confidentiality Low

Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

What the vulnerability does

01Description

Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Codeat Glossary plugin <= 2.1.27 versions.

Explanation of Vulnerability in Simple Terms

02Summary

Codeat Glossary versions up to 2.1.27 contain a cross-site scripting (XSS) vulnerability that allows authenticated users to inject malicious scripts. The vulnerability requires user interaction and affects the scope beyond the vulnerable component. An attacker with low privileges can craft a malicious link to execute JavaScript in other users' browsers, potentially stealing session data or performing actions on their behalf.

What an attacker can do

03Attacker Capabilities

Inject and execute malicious JavaScript in other users' browsers via a crafted link.

Potential impact on your site

04Site Impact

Authenticated users can be tricked into executing attacker-controlled scripts, risking account compromise or data theft.

Conditions required to exploit

05Prerequisites

Attacker must have a low-privilege account and the victim must click a malicious link.

Key dates

06Disclosure timeline

April 6, 2023 CVE published

April 28, 2026 Record updated

External resources

07References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2023-24378 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/79.html AskarLabs — CWE-79 write-up Cross-Site Scripting

Related vulnerabilities