What the vulnerability does
01Description
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Nose Graze Novelist plugin <= 1.2.0 versions.
CVE-2023-32958
MEDIUM
CVE-2023-32958: WordPress Novelist Plugin <= 1.2.0 is vulnerable to Cross Site Scripting (XSS)
CVSS base score
5.9/10
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
Explanation of Vulnerability in Simple Terms
02Summary
Novelist versions up to 1.2.0 contain a cross-site scripting vulnerability that allows authenticated administrators to inject malicious scripts. The vulnerability requires user interaction—typically clicking a crafted link—and affects the site's integrity and confidentiality. Update to version 1.3.0 or later to resolve this issue.
What an attacker can do
03Attacker Capabilities
Inject malicious scripts that execute in other users' browsers when they visit affected pages.
Potential impact on your site
04Site Impact
An admin account could be compromised to inject scripts affecting site visitors' data and trust.
Conditions required to exploit
05Prerequisites
Attacker must have administrator privileges and the victim must click a malicious link or visit a crafted page.
Key dates
06Disclosure timeline
May 28, 2023
CVE published
April 28, 2026
Record updated
External resources
07References
Related vulnerabilities
08Related CVE
CVE-2026-6454 Firelight Lightbox <= 2.3.20 - Authenticated (Contributor+) Stored DOM Cross-Site Scripting via PDF beforeLoad 'href' Attribute
CVE-2026-65438 WordPress Message Filter for Contact Form 7 plugin <= 1.6.3.9 - Cross Site Scripting (XSS) vulnerability
CVE-2026-17162 WowStore <= 4.4.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'currentPostId' Block Attribute
CVE-2026-15730 GamiPress <= 7.9.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'heading_size' Shortcode Attribute
CVE-2026-15464 WP Hotel Booking <= 2.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'widget_search' Shortcode Attribute
