{"id":"CVE-2023-5470","aliases":["EUVD-2023-57784","GHSA-hh2j-wjqr-83pc"],"status":"published","title":"Etsy Shop \u003c= 3.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","description":"The Etsy Shop plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'etsy-shop' shortcode in versions up to, and including, 3.0.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","severity":{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00536,"percentile":0.45492,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2023-10-12T06:38:29Z","modified":"2026-06-17T06:48:39Z","products":[{"vendor":"etsy_shop_project","product":"etsy_shop"},{"vendor":"fsheedy","product":"etsy shop"},{"vendor":"unknown","product":"etsy shop"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e4696f7a-8b87-4376-b4c9-596eca30b38c?source=cve","tags":["x_transferred","Third Party Advisory"]},{"url":"https://plugins.trac.wordpress.org/browser/etsy-shop/tags/3.0.4/etsy-shop.php#L94","tags":["x_transferred","Patch"]},{"url":"https://plugins.trac.wordpress.org/browser/etsy-shop/tags/3.0.4/etsy-shop.php#L417","tags":["x_transferred","Patch"]},{"url":"https://plugins.trac.wordpress.org/changeset/2977260/etsy-shop#file1","tags":["x_transferred","Patch"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-5470"},{"url":"https://github.com/advisories/GHSA-hh2j-wjqr-83pc"}],"sources":{"cve":[{"id":"CVE-2023-5470","title":"Etsy Shop \u003c= 3.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","description":"The Etsy Shop plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'etsy-shop' shortcode in versions up to, and including, 3.0.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","status":"published","published":"2023-10-12T06:38:29.925Z","modified":"2026-04-08T17:29:37.39Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:35:16.771348Z"}],"euvd":[{"id":"EUVD-2023-57784","description":"The Etsy Shop plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'etsy-shop' shortcode in versions up to, and including, 3.0.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","status":"published","published":"2023-10-12T06:38:29Z","modified":"2026-04-08T17:29:37Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T19:24:36.442052Z"}],"ghsa":[{"id":"GHSA-hh2j-wjqr-83pc","title":"The Etsy Shop plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'etsy-shop'...","description":"The Etsy Shop plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'etsy-shop' shortcode in versions up to, and including, 3.0.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","status":"published","published":"2023-10-12T09:30:26Z","modified":"2024-04-04T08:35:16Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:56:59.652212Z"}],"nvd":[{"id":"CVE-2023-5470","description":"The Etsy Shop plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'etsy-shop' shortcode in versions up to, and including, 3.0.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","status":"published","published":"2023-10-12T07:15:11.12Z","modified":"2026-06-17T06:48:39.323Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:08:37.83429Z"}]}}