What’s Vulnerable › Vulnerabilities

CVE-2023-0333: TemplatesNext ToolKit < 3.2.9 - Contributor+ Stored XSS

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-02-13 · updated 2026-06-17

Description

The TemplatesNext ToolKit WordPress plugin before 3.2.9 does not validate some of its shortcode attributes before using them to generate an HTML tag, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks

Affected products

• TemplatesNext ToolKit: before 3.2.9 — fixed in 3.2.9

How to fix

Upgrade to a fixed version: TemplatesNext ToolKit 3.2.9. Check the vendor advisory for mitigations.

References

• https://wpscan.com/vulnerability/e86ff4d5-d549-4c71-b80e-6a9b3bfddbfc
• https://wpscan.com/vulnerability/e86ff4d5-d549-4c71-b80e-6a9b3bfddbfc

Get alerted when CVE-2023-0333 or the next vulnerability affects your stack