CVE-2023-6806: The Starbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Job Settings user profile fields in all versions up to, and including, 3.4.8 due to insufficient input sanitizatio

medium Affects starbox (WordPress plugin). Feed 2026.10.29.1, updated 2026-10-28; published 2024-02-29; advisory modified 2026-06-17.

The Starbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Job Settings user profile fields in all versions up to, and including, 3.4.8 due to insufficient input sanitizatio

Package: starbox (WordPress plugin) WordPress
Affected versions: <3.5.0
Fixed in: 3.5.0
Severity: medium CVSS 6.4
Exploitation: not on CISA KEV · EPSS 0% (36.5th percentile)
Published: 2024-02-29
Source: nvd

References

CWE-79

NVD record starbox (WordPress plugin) advisories

Am I affected?

Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.

# one-time install
pip install phpwarden

# then
phpwarden wordpress /var/www/html

Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.

Install docs How findings are ranked

Related advisories

CVE-2024-0366 medium The Starbox – the Author Box for Humans plugin for WordPress is vulnerable to Insecure Dir same package: starbox (WordPress plugin)
CVE-2024-1273 medium The Starbox WordPress plugin before 3.5.0 does not sanitise and escape some parameters, wh same package: starbox (WordPress plugin)
CVE-2024-7955 medium The Starbox WordPress plugin before 3.5.2 does not sanitise and escape some of its settin same package: starbox (WordPress plugin)
CVE-2024-8239 medium The Starbox WordPress plugin before 3.5.3 does not properly render social media profiles same package: starbox (WordPress plugin)
CVE-2024-0256 medium The Starbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Prof same package: starbox (WordPress plugin)
CVE-2020-11023 KEV medium Potential XSS vulnerability in jQuery same weakness: CWE-79