4.8
Medium
CVE-2023-5137 The Simply Excerpts WordPress plugin through 1.4 does not sanitize and escape some fields in the plugin settings,…
Description
The Simply Excerpts WordPress plugin through 1.4 does not sanitize and escape some fields in the plugin settings, which could allow high-privilege users such as an administrator to inject arbitrary web scripts even when the unfiltered_html capability is disallowed (for example in a multisite setup).
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Simply Excerpts 1.4 | earliest → 1.4 | No fix stated |