WordPress WP-Appbox plugin <= 4.3.20 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability
Description
Authenticated (admin user role) Stored Cross-Site Scripting (XSS) in WP-Appbox (WordPress plugin) <= 4.3.20.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2- Marcel Schmilgeit/WP-Appbox (WordPress plugin)v5Range: <= 4.3.20
Patches
Vulnerability mechanics
Root cause
"The plugin does not properly sanitize user-supplied data when rendering app information, allowing for the injection of malicious scripts."
Attack vector
An authenticated administrator user can insert a crafted shortcode into a WordPress post or page. This shortcode contains JavaScript code within one of the parameters, such as the app ID. When another user views the post or page containing this shortcode, the embedded JavaScript is executed in their browser, leading to a stored XSS attack [ref_id=1].
Affected code
The vulnerability lies within the WP-Appbox plugin, specifically in how it processes and displays data from shortcodes. The exact functions or files are not detailed in the provided changelog, but the fix involves sanitizing inputs related to app details that are rendered on the frontend [ref_id=1].
What the fix does
The patch addresses the vulnerability by sanitizing user input before it is rendered on the page. Specifically, it ensures that any HTML or script tags within the app ID or other shortcode parameters are properly escaped. This prevents the browser from interpreting the injected code as executable JavaScript, thereby mitigating the XSS risk [ref_id=1].
Preconditions
- authThe attacker must have administrator privileges within the WordPress installation.
- inputThe attacker must be able to insert a specially crafted shortcode into a post or page.
Generated on Jun 7, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
2- patchstack.com/database/vulnerability/wp-appbox/wordpress-wp-appbox-plugin-4-3-20-authenticated-stored-cross-site-scripting-xss-vulnerabilitymitrex_refsource_CONFIRM
- wordpress.org/plugins/wp-appbox/mitrex_refsource_CONFIRM
News mentions
0No linked articles in our index yet.