The WP Recipe Maker plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'Referer' header in all versions up to, and including, 9.1.0 due to insufficient input sanitization and output escaping. The Referer header value is used directly in the href attribute of the "Back" button on the print page without proper escaping. [已公开] id: CVE-2023-6970 info: name: WP Recipe Maker <= 9.1.0 - Reflected XSS via Referer Header author: Shivam Kamboj severity: medium description: | The WP Recipe Maker plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'Referer' header in all versions up to, and including, 9.1.0 due to insufficient input sanitization and output escaping. The Referer header value is used directly in the href attribute of the "Back" button on the print page without proper escaping. impact: | Attackers can execute arbitrary scripts in the context of the victim's browser, potentially leading to session hijacking or defacement. remediation: | Update to the latest version of WP Recipe Maker plugin. reference: - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wp-recipe-maker/wp-recipe-maker-910-reflected-cross-sit

未知