exploitDog

CVE-2023-5942

Опубликовано: 27 нояб. 2023

Источник: nvd

CVSS3: 5.4

EPSS Низкий

Описание

The Medialist WordPress plugin before 1.4.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks

Ссылки

https://wpscan.com/vulnerability/914559e1-eed5-4a69-8371-a48055835453
Exploit
Third Party Advisory
https://wpscan.com/vulnerability/914559e1-eed5-4a69-8371-a48055835453
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:drelton:medialist:*:*:*:*:*:wordpress:*:*

Версия до 1.4.1 (исключая)

EPSS

Процентиль: 36%

0.0015

Низкий

5.4 Medium

CVSS3

Дефекты

CWE-79

Связанные уязвимости

GHSA-5c7f-c4vf-5xcw

CVSS3: 5.4

github

около 2 лет назад

The Medialist WordPress plugin before 1.4.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks

EPSS

Процентиль: 36%

0.0015

Низкий

5.4 Medium

CVSS3

Дефекты

CWE-79