CVE-2023-6624 in Import and Export Users and Customers Plugin
Summary
by MITRE • 01/11/2024
The Import and export users and customers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 1.24.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 04/11/2026
The vulnerability identified as CVE-2023-6624 affects the Import and export users and customers plugin for WordPress, representing a critical stored cross-site scripting weakness that has persisted through all versions up to and including 1.24.3. This vulnerability resides within the plugin's shortcode implementation and stems from inadequate input sanitization and output escaping mechanisms that fail to properly validate user-supplied attributes before processing them. The flaw specifically targets the plugin's handling of shortcode parameters, creating an attack vector that allows malicious actors to inject persistent web scripts into the WordPress environment.
The technical exploitation of this vulnerability requires an attacker to possess at least contributor-level permissions within the WordPress installation, which represents a significant concern given that contributors typically have substantial access to content management capabilities. Attackers can leverage this privilege level to inject malicious scripts through the plugin's shortcode attributes, which are then stored within the WordPress database and executed whenever any user accesses pages containing the injected content. This stored nature of the XSS vulnerability means that the malicious payload persists until manually removed, potentially affecting multiple users over extended periods.
The operational impact of CVE-2023-6624 extends beyond simple script execution, as it creates opportunities for attackers to escalate privileges, steal session cookies, perform unauthorized actions on behalf of users, and potentially gain access to sensitive administrative functions. The vulnerability aligns with CWE-79 which specifically addresses cross-site scripting flaws, and demonstrates characteristics consistent with ATT&CK technique T1566.001 for initial access through malicious content. When exploited, the vulnerability can result in complete compromise of user sessions, data exfiltration, and potential lateral movement within the compromised WordPress environment.
Mitigation strategies for this vulnerability must include immediate patching of the affected plugin to version 1.24.4 or later, which contains the necessary sanitization and escaping fixes. Organizations should also implement additional defensive measures such as restricting contributor-level permissions to only essential functions, implementing content security policies to limit script execution, and conducting regular security audits of installed plugins. The vulnerability demonstrates the importance of proper input validation and output escaping as outlined in OWASP Top 10 security practices, particularly addressing the need for comprehensive sanitization of all user-supplied data before processing within web applications. Security monitoring should focus on identifying unauthorized shortcode modifications and unusual plugin activity that might indicate exploitation attempts.