CVE-2023-0603

Sloth Logo Customizer <= 2.0.2 - Stored XSS via CSRF

The Sloth Logo Customizer WordPress plugin through 2.0.2 does not have CSRF check when updating its settings, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack

Affected

Sloth Logo Customizer

CVSS v3.1 NVD

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

13.87% chance of exploitation in the next 30 days, 96th percentile

Published

2023-05-08

Updated

2025-04-23

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/1c93ea8f-4e68-4da1-994e-35a5873278ba

References

• CVE Record
• NVD entry