CVE-2023-0442

Name of the Vulnerable Software and Affected Versions Loan Comparison WordPress plugin versions prior to 1.5.3

Description The issue allows an attacker to inject javascript into a site via a crafted URL, as the plugin does not validate and escape some of its query parameters before outputting them back in a page/post via an embedded shortcode.

Recommendations For versions prior to 1.5.3, update to version 1.5.3 or later to resolve the issue. As a temporary workaround, consider restricting the use of embedded shortcodes until a patch is applied.