CVE-2023-4271 in Photospace Responsive Plugin
Summary
by MITRE • 10/25/2023
The Photospace Responsive plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘psres_button_size’ parameter in versions up to, and including, 2.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 04/10/2026
The Photospace Responsive WordPress plugin vulnerability represents a critical stored cross-site scripting flaw that emerged in versions up to and including 2.1.1. This security weakness resides within the plugin's handling of the 'psres_button_size' parameter, creating a persistent vector for malicious code injection that can compromise user sessions and execute unauthorized scripts. The vulnerability specifically targets multi-site WordPress installations where the unfiltered_html capability has been disabled, making it particularly concerning for organizations with strict security policies and multi-tenant environments. The flaw stems from inadequate input sanitization mechanisms that fail to properly validate or escape user-supplied data before processing, allowing attackers to embed malicious JavaScript code that persists in the application's database.
The technical exploitation of this vulnerability requires an authenticated attacker possessing administrator-level permissions or higher, which significantly reduces the attack surface but does not eliminate the risk entirely. Attackers can leverage this privilege to inject malicious scripts through the vulnerable parameter, which then executes whenever any user accesses pages containing the injected content. This stored XSS vector operates by bypassing normal input validation controls and exploiting the plugin's insufficient output escaping mechanisms that fail to properly encode or sanitize rendered content. The vulnerability's impact is amplified in multi-site installations where the attacker can potentially compromise multiple individual sites within the network, creating a cascading security risk that extends beyond a single WordPress instance.
The operational implications of this vulnerability extend beyond simple script execution, as it provides attackers with persistent access to affected systems and can be leveraged for more sophisticated attacks including session hijacking, data exfiltration, and privilege escalation. The requirement for administrator-level access means that this vulnerability typically indicates a broader security misconfiguration or insider threat risk within the organization, as it represents a failure in the principle of least privilege enforcement. Organizations utilizing the Photospace Responsive plugin in multi-site configurations with restricted HTML capabilities are particularly at risk, as these environments often house sensitive data and critical business applications where such vulnerabilities can lead to significant financial and reputational damage. The vulnerability's persistence in the database means that even if the initial attack vector is patched, the malicious content remains until manually removed from the affected installations.
Mitigation strategies for this vulnerability should prioritize immediate plugin updates to versions that address the stored XSS flaw, while also implementing comprehensive input validation and output escaping measures throughout the application. Security teams should conduct thorough audits of all installed plugins to identify similar vulnerabilities that may exist in other third-party components, particularly those handling user input in multi-site configurations. The implementation of web application firewalls and content security policies can provide additional defense-in-depth measures to detect and prevent exploitation attempts, while regular security monitoring should be established to identify potential compromise indicators. Organizations should also review their user permission structures to ensure that the principle of least privilege is properly enforced, limiting administrative access to only those users who require such elevated privileges for their legitimate work functions. This vulnerability highlights the critical importance of maintaining up-to-date security practices and the necessity of implementing robust input validation controls that align with industry standards such as those recommended by the CWE database and ATT&CK framework for preventing persistent cross-site scripting attacks.