CVE-2023-4271

The Photospace Responsive plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘psres_button_size’ parameter in versions up to, and including, 2.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

• CWE-79
• CWE-79

• https://plugins.trac.wordpress.org/changeset/2831424/photospace-responsive/trunk/includes/class-photospace-responsive-gallery.php?contextall=1&old=2544748&old_path=%2Fphotospace-responsive%2Ftrunk%2Fincludes%2Fclass-photospace-responsive-gallery.phpPatch
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2966110%40photospace-responsive%2Ftrunk&old=2875667%40photospace-responsive%2Ftrunk&sfp_email=&sfph_mail=Patch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/3bc98896-6ff9-40de-ace2-2ca331c2a44a?source=cvePatch, Third Party Advisory
• https://plugins.trac.wordpress.org/changeset/2831424/photospace-responsive/trunk/includes/class-photospace-responsive-gallery.php?contextall=1&old=2544748&old_path=%2Fphotospace-responsive%2Ftrunk%2Fincludes%2Fclass-photospace-responsive-gallery.phpPatch
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2966110%40photospace-responsive%2Ftrunk&old=2875667%40photospace-responsive%2Ftrunk&sfp_email=&sfph_mail=Patch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/3bc98896-6ff9-40de-ace2-2ca331c2a44a?source=cvePatch, Third Party Advisory

Published

Oct 20, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-42704In imsservice, there is a possible way to write permission u…5.5
• CVE-2023-42705In imsservice, there is a possible way to write permission u…5.5
• CVE-2023-42706In firewall service, there is a possible way to write permis…5.5
• CVE-2023-42707In firewall service, there is a possible way to write permis…5.5
• CVE-2023-42708In firewall service, there is a possible way to write permis…5.5
• CVE-2023-42709In firewall service, there is a possible way to write permis…5.5
• CVE-2023-42710In firewall service, there is a possible way to write permis…5.5
• CVE-2023-42711In firewall service, there is a possible way to write permis…5.5
• CVE-2023-42712In firewall service, there is a possible way to write permis…5.5
• CVE-2023-42713In firewall service, there is a possible way to write permis…5.5
• CVE-2023-42714In firewall service, there is a possible way to write permis…5.5
• CVE-2023-42715In telephony service, there is a possible missing permission…5.5