CVE-2023-0150 in Cloak Front End Email Plugin
Summary
by MITRE • 02/06/2023
The Cloak Front End Email WordPress plugin before 1.9.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 03/25/2025
The vulnerability identified as CVE-2023-0150 affects the Cloak Front End Email WordPress plugin version 1.9.1 and earlier, presenting a critical security risk through stored cross-site scripting exploitation. This flaw resides in the plugin's handling of shortcode attributes, where insufficient validation and escaping mechanisms allow malicious actors to inject persistent script code into web pages. The vulnerability specifically targets users with contributor role and above, which includes authors, editors, and administrators who possess the capability to modify content within WordPress environments. The affected plugin fails to properly sanitize user-supplied input before rendering it back to the browser, creating an avenue for attackers to execute malicious scripts in the context of the victim's browser session.
The technical implementation of this vulnerability stems from improper input validation within the plugin's shortcode processing functionality. When administrators or contributors embed plugin shortcodes within posts or pages, the plugin fails to adequately escape or validate attributes such as email addresses, display text, or other configurable parameters. This oversight creates a persistent XSS vector where malicious scripts can be stored in the database and executed whenever the affected page is loaded. The vulnerability operates under CWE-79 which classifies the issue as a failure to sanitize or escape output, specifically manifesting as a stored cross-site scripting condition. Attackers can leverage this weakness by crafting malicious shortcode attributes containing script tags or other malicious code that gets stored in the WordPress database and subsequently executed in the browsers of unsuspecting visitors.
The operational impact of CVE-2023-0150 extends beyond simple script execution, potentially enabling attackers to perform session hijacking, defacement of content, or redirection to malicious websites. Since the vulnerability affects users with contributor roles and above, it represents a significant threat to WordPress sites where multiple users have editing privileges. The stored nature of the XSS means that once the malicious code is injected, it persists until manually removed from the database or the plugin is updated. This characteristic makes the vulnerability particularly dangerous in environments where content is frequently edited by multiple contributors. The attack vector aligns with ATT&CK technique T1566.001 which involves the exploitation of web applications through input validation weaknesses, specifically targeting the persistence of malicious payloads within content management systems.
Organizations should immediately update to version 1.9.2 or later of the Cloak Front End Email plugin to remediate this vulnerability. Additionally, administrators should implement proper input validation measures including the use of WordPress's built-in sanitization functions and the principle of least privilege when assigning user roles. Security monitoring should include regular scanning for malicious code within stored content, particularly in areas where shortcodes are utilized. The vulnerability demonstrates the importance of proper output escaping and input validation in web applications, particularly within content management systems where user-generated content processing occurs. Regular security audits of WordPress plugins and themes remain essential to identify similar vulnerabilities that could compromise site integrity and user security.