Cross-site scripting in josevega Display custom fields in the frontend – Post and User…
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.
Summary
The Display custom fields in the frontend – Post and User Profile Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode and postmeta in all versions up to, and including, 1.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| josevega | Display custom fields in the frontend – Post and User Profile Fields | up to 1.2.1 | — | No fix listed | CNA |
- Display custom fields in the frontend – Post and User Profile Fields Vendorjosevega Affected up to 1.2.1 Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:vegacorp:display_custom_fields_in_the_frontend_-_post_and_user_profile_fields:*:*:*:*:*:wordpress:*:* | before 1.3.0 | Vulnerable | Vegacorp |
- cpe:2.3:a:vegacorp:display_custom_fields_in_the_frontend_-_post_and_user_profile_fields:*:*:*:*:*:wordpress:*:* Versions before 1.3.0 Vulnerable ·Vegacorp
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2023-6982
- 2026-10-03 Alias added: GHSA-fc5m-43m8-862c
References
Patch 2
- https://www.wordfence.com/threat-intel/vulnerabilities/id/3077b84e-87af-4307-83c5-0e4b15d07ff1?source=cve
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3021133%40shortcode-to-display-post-and-user-data&new=3021133%40shortcode-to-display-post-and-user-data&sfp_email=&sfph_mail=
More josevega vulnerabilities
- TI-2023-06396 Code injection in josevega Display custom fields in the frontend – Post and User Profile… CVSS 3.1HIGH 8.8
- TI-2025-35752 WordPress WP Frontend Admin plugin <= 1.22.7 - Cross Site Scripting (XSS) vulnerability CVSS 3.1MEDIUM 6.5
- TI-2022-04562 Freemius SDK <= 2.4.2 - Missing Authorization Checks CVSS 3.1MEDIUM 6.3
- TI-2024-12404 Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter CVSS 3.1MEDIUM 6.1
- TI-2026-44324 WordPress WooCommerce Bulk Edit Products – WP Sheet Editor plugin <= 1.8.21 - Broken Access Control vulnerability CVSS 3.1MEDIUM 4.9
- TI-2023-14799 WordPress Shortcode to display post and user data plugin <= 1.2.0 - Broken Access Control vulnerability CVSS 3.1MEDIUM 4.3
Sources
- CVE-2023-6982 · CVE Program
- CVE-2023-6982 · NVD
- FIRST EPSS
- GHSA-fc5m-43m8-862c · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences