Medium severity6.4NVD Advisory· Published Nov 7, 2023· Updated Apr 8, 2026

CVE-2023-5076

Description

The Ziteboard Online Whiteboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ziteboard' shortcode in versions up to, and including, 2.9.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Affected products

Ziteboard/Ziteboard
cpe:2.3:a:ziteboard:ziteboard:*:*:*:*:*:wordpress:*:*
Range: <=2.9.9

Patches

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

plugins.trac.wordpress.org/changeset/2988896/ziteboard-online-whiteboardnvdPatch
www.wordfence.com/threat-intel/vulnerabilities/id/f5608f50-e17a-471f-b644-dceb64d82f0cnvdThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.416
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000