CVE-2023-4290 Information

Description

The WP Matterport Shortcode WordPress plugin before 2.1.7 does not escape the PHP_SELF server variable when outputting it in attributes leading to Reflected Cross-Site Scripting issues which could be used against high privilege users such as admin

Reference

https://wpscan.com/vulnerability/5fad5245-a089-4ba3-9958-1e2c3d066eea