CVE-2023-2654 – Conditional Menus < 1.2.1 - Reflected XSS

https://notcve.org/view.php?id=CVE-2023-2654

24 May 2023 — The Conditional Menus WordPress plugin before 1.2.1 does not escape a parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin The Conditional Menus plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'current_page' and 'num_of_pages ' parameters in versions up to, and including, 1.2.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenti... • https://wpscan.com/vulnerability/506ecee9-8e42-46de-9c5c-fc252ab2646e • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •