6.1
Medium
CVE-2023-2023 The Custom 404 Pro WordPress plugin before 3.7.3 does not escape some URLs before outputting them in attributes, leading…
Description
The Custom 404 Pro WordPress plugin before 3.7.3 does not escape some URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Custom 404 Pro 3.7 | earliest → < 3.7.3 | 3.7.3 |