CVE-2023-34372 MEDIUM

CVE-2023-34372: WordPress Download SpamReferrerBlock Plugin <= 2.22 is vulnerable to Cross Site Scripting (XSS)

Vendor Didier Sampaolo

Product SpamReferrerBlock

Weakness CWE-79 · XSS

Published August 30, 2023

Last update April 28, 2026

View on NVD All CVEs

CVSS base score

5.9/10

Attack vector Network

Attack complexity Low

Privileges required High

User interaction Required

Confidentiality Low

Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L

What the vulnerability does

01Description

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Didier Sampaolo SpamReferrerBlock plugin <= 2.22 versions.

Explanation of Vulnerability in Simple Terms

02Summary

SpamReferrerBlock through version 2.22 contains a cross-site scripting (XSS) vulnerability that allows an authenticated administrator to inject malicious scripts. The vulnerability requires user interaction—typically clicking a crafted link—and affects the integrity and confidentiality of site data. An attacker with high-level privileges can execute JavaScript in the context of other users' browsers.

What an attacker can do

03Attacker Capabilities

Inject and execute malicious JavaScript in the admin panel or site frontend, affecting other users' sessions.

Potential impact on your site

04Site Impact

An admin account could be compromised or manipulated to perform unintended actions; site data and user sessions at risk.

Conditions required to exploit

05Prerequisites

Attacker must have administrator-level access and trick a user into clicking a malicious link or visiting a crafted page.

Key dates

06Disclosure timeline

August 30, 2023 CVE published

April 28, 2026 Record updated

External resources

07References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2023-34372 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/79.html AskarLabs — CWE-79 write-up Cross-Site Scripting

Related vulnerabilities