Security readout for executives and security teams
Plain-English summary
CVE-2023-6923 is a reflected cross-site scripting issue in the Matomo Analytics WordPress plugin. An attacker does not need an account, but must convince a user to click or otherwise load a crafted link. Successful abuse could run script in that user’s browser, risking session or data exposure within the affected site context.
Executive priority
Address during the next normal WordPress security maintenance cycle, faster for sites with administrator-heavy workflows or sensitive analytics access. This is not described as actively exploited, but unauthenticated reflected XSS can still create business risk through targeted phishing.
Technical view
The flaw is CWE-79 caused by insufficient sanitization and output escaping of the idsite parameter in Matomo Analytics for WordPress through version 4.15.3. CVSS 3.1 is 6.1 with network access, low complexity, no privileges, and required user interaction. Scope changes, with low confidentiality and integrity impact and no availability impact.
Likely exposure
Exposure is limited to WordPress sites using the Matomo Analytics plugin at versions up to and including 4.15.3. The source metadata is sparse, so confirm installed plugin name and version directly in WordPress inventory before prioritizing.
Exploitation context
The CVE source bundle does not identify active exploitation, and KEV status is false. Practical exploitation requires social engineering or another way to get a victim to load attacker-controlled input. Treat it as credible but not emergency-level unless the plugin is internet-facing and used by privileged users.
Researcher notes
Key evidence comes from the CVE description, Wordfence advisory, and WordPress plugin changeset reference. The affected metadata in the bundle is incomplete, so rely on the narrative version range and vendor-linked references. Avoid assuming exploit maturity, fixed version number, or compensating controls not stated in sources.
Mitigation direction
- Inventory WordPress sites for the Matomo Analytics plugin.
- Update affected installations to a vendor-confirmed fixed release newer than 4.15.3.
- If immediate update is blocked, monitor vendor and Wordfence guidance.
- Restrict administrative browsing from untrusted links where possible.
- Review WAF or security plugin coverage for reflected XSS patterns.
Validation and detection
- Confirm installed plugin versions across all WordPress environments.
- Verify no production site runs Matomo Analytics 4.15.3 or earlier.
- Review recent web logs for unusual idsite parameter activity.
- Use safe application testing to confirm idsite output is escaped.
- Document any affected sites and remediation dates.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-79: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2023-6923 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N2.82.7Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
6.1MediumVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://www.wordfence.com/threat-intel/vulnerabilities/id/2e2d54eb-c176-49c4-a4fc-833e17189cad?source=cveCVE reference
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3031495%40matomo&new=3031495%40matomo&sfp_email=&sfph_mail=CVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.