CVE-2023-4017

Vulnerability

Overview

The Goya WordPress theme versions up to and including 1.0.8.7 are affected by a reflected cross-site scripting (XSS) vulnerability. The issue stems from insufficient input sanitization and output escaping in the attra-color, attra-size, and product-cata parameters. This allows unauthenticated attackers to inject arbitrary web scripts into pages [1].

Exploitation

Prerequisites

Exploitation requires no authentication and can be achieved by tricking a user into clicking a crafted link that includes malicious payloads within the vulnerable parameters. The attacker does not need any special network position; a standard HTTP request to the vulnerable site is sufficient [1].

Impact and

Mitigation

Successful exploitation enables an attacker to execute arbitrary JavaScript in the browser of the victim user, potentially leading to session hijacking, credential theft, or defacement. The vulnerability was addressed in Goya theme version 1.0.8.8, as noted in the changelog. Users are strongly advised to update to the latest version to mitigate the risk [1].