CVE-2023-36692

23th percentile - higher than 23% of all known CVEs

The WP-Cirrus plugin versions up to 0.6.11 contain a stored Cross-Site Scripting (XSS) vulnerability with admin authorization. An attacker can exploit this flaw to inject malicious scripts that will be executed in the victim's browser context.

Exploitation of this vulnerability may lead to user data theft or session hijacking. Organizations should be aware of the risks associated with using this plugin in their systems.

It is recommended to update the WP-Cirrus plugin to the latest version to mitigate this vulnerability. Additionally, conducting a security audit of the application to identify other potential flaws is advisable.