CVE-2023-38521

22th percentile - higher than 22% of all known CVEs

The Exifography plugin versions up to 1.3.1 have a stored Cross-Site Scripting (XSS) vulnerability with admin authorization. An attacker can exploit this flaw to inject malicious scripts that will be executed in the victim's browser context.

Organizations may be exposed to data theft, session hijacking, or other attacks that could lead to a loss of trust in the system. Specifically, an attacker with admin account access could introduce malicious scripts affecting all users.

It is recommended to update the Exifography plugin to the latest version to mitigate this vulnerability. Additionally, conducting a security audit to identify and eliminate potential XSS threats is advisable.