exploitDog

CVE-2023-0172

Опубликовано: 13 мар. 2023

Источник: nvd

CVSS3: 5.4

EPSS Низкий

Описание

The Juicer WordPress plugin before 1.11 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks

Ссылки

https://wpscan.com/vulnerability/c8982b8d-985f-4a5d-840d-e8be7c3405bd
Exploit
Third Party Advisory
https://wpscan.com/vulnerability/c8982b8d-985f-4a5d-840d-e8be7c3405bd
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:saas.group:juicer:*:*:*:*:*:wordpress:*:*

Версия до 1.11 (исключая)

EPSS

Процентиль: 40%

0.0018

Низкий

5.4 Medium

CVSS3

Дефекты

CWE-79

Связанные уязвимости

GHSA-gw97-25fq-5h49

CVSS3: 5.4

github

почти 3 года назад

The Juicer WordPress plugin before 1.11 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks

EPSS

Процентиль: 40%

0.0018

Низкий

5.4 Medium

CVSS3

Дефекты

CWE-79