CVE-2023-6990 in Weaver Xtreme Plugin
Summary
by MITRE • 01/11/2024
The Weaver Xtreme theme for WordPress is vulnerable to Stored Cross-Site Scripting via custom post meta in all versions up to, and including, 6.3.0 due to insufficient input sanitization and output escaping on user supplied meta (page-head-code). This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 04/11/2026
The vulnerability identified as CVE-2023-6990 affects the Weaver Xtreme theme for WordPress, representing a critical security flaw that enables stored cross-site scripting attacks. This issue exists in all versions up to and including 6.3.0, making it a widespread concern for WordPress users who have implemented this particular theme. The vulnerability stems from inadequate input sanitization and output escaping mechanisms within the theme's handling of user-supplied data, specifically targeting custom post meta fields designated as page-head-code. The flaw allows authenticated attackers with contributor-level permissions or higher to inject malicious scripts that persist in the system and execute whenever users access affected pages, creating a persistent threat vector that can compromise user sessions and potentially lead to further system exploitation.
The technical implementation of this vulnerability involves the theme's failure to properly sanitize user input before storing it in the database and subsequently outputting it without adequate escaping mechanisms. When administrators or contributors with appropriate permissions create or edit custom post meta fields containing page-head-code, the theme processes this input without sufficient validation or sanitization. This creates a stored XSS condition where malicious scripts can be embedded in legitimate content and executed in the context of other users' browsers. The vulnerability is particularly dangerous because it requires only contributor-level privileges, which are often granted to trusted users who may not be fully security-aware, making it a significant risk for organizations that rely on user-generated content management.
The operational impact of this vulnerability extends beyond simple script execution, as it provides attackers with the ability to manipulate user sessions, steal cookies, perform actions on behalf of users, and potentially escalate privileges within the WordPress environment. The stored nature of the vulnerability means that once an attacker successfully injects malicious code, it remains active until manually removed, creating a persistent threat that can affect multiple users over extended periods. This type of vulnerability directly maps to CWE-79, which describes Cross-Site Scripting flaws, and aligns with ATT&CK technique T1566.001 for initial access through spearphishing attachments, though in this case the attack vector is through legitimate user permissions rather than external phishing. The vulnerability also represents a significant concern for compliance with security standards such as ISO 27001 and NIST cybersecurity frameworks, as it creates exploitable conditions that can lead to data breaches and unauthorized access.
Mitigation strategies for CVE-2023-6990 should prioritize immediate updates to the Weaver Xtreme theme to versions that address the input sanitization and output escaping deficiencies. Organizations should also implement additional security measures including regular security audits of theme and plugin code, enhanced user permission controls to limit contributor privileges where possible, and comprehensive monitoring of user activities within the WordPress administration area. Security teams should consider implementing Content Security Policy headers to limit script execution capabilities in browsers, while also establishing procedures for regular vulnerability scanning and penetration testing. The remediation process should include thorough testing of updated themes in staging environments before deployment to production systems, ensuring that the fix properly addresses the sanitization and escaping mechanisms without introducing new compatibility issues. Additionally, administrators should educate users about the risks of entering untrusted code into meta fields and establish clear policies regarding content approval and security review processes for all user-generated content within WordPress installations.