CVE-2023-1978 is a medium-severity vulnerability affecting the ShiftController Employee Shift Scheduling plugin for WordPress in versions up to and including 4.9.25. This vulnerability, known as Reflected Cross-Site Scripting, occurs due to insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary web scripts in pages. These scripts can execute if the attacker successfully tricks a user into performing an action, such as clicking on a link. Systems running the affected plugin versions are at risk.

How do I know if I'm affected?

If you're using the ShiftController Employee Shift Scheduling plugin for WordPress, you might be affected by the vulnerability. This issue impacts versions up to and including 4.9.25. To check if you're affected, simply verify the version of the plugin you have installed on your WordPress site. If it's 4.9.25 or earlier, your site is at risk of this medium-severity vulnerability, which could allow attackers to inject harmful scripts into your web pages.

What should I do if I'm affected?

If you're affected by the vulnerability, it's crucial to update your ShiftController Employee Shift Scheduling plugin to version 4.9.26 or newer. To do this, simply go to your WordPress dashboard, navigate to the plugins section, find the ShiftController plugin, and click "Update" if available. This will help protect your site from potential attacks.

Is CVE-2023-1978 in CISA’s Known Exploited Vulnerabilities Catalog?

The CVE-2023-1978 vulnerability is not listed in CISA's Known Exploited Vulnerabilities Catalog. This issue, affecting the ShiftController Employee Shift Scheduling plugin for WordPress, is a medium-severity Reflected Cross-Site Scripting vulnerability. It was published on June 9, 2023. There is no specific due date or required action mentioned, but updating the plugin to version 4.9.26 or newer can help mitigate the risk.

Weakness enumeration

The weakness enumeration for this vulnerability is categorized as NVD-CWE-noinfo.

For more details

CVE-2023-1978 is a medium-severity vulnerability affecting the ShiftController Employee Shift Scheduling plugin for WordPress. Users are advised to update their plugin to version 4.9.26 or newer to mitigate the risk. For a comprehensive understanding of the vulnerability, including its description, severity, technical details, and known affected software configurations, visit the NVD page or the links below.

• Changeset 2898274 for ShiftController – WordPress Plugin Repository

• ShiftController Employee Shift Scheduling <= 4.9.25 - Reflected Cross-Site Scripting via Query String