CVE-2023-2624

KiviCare Management System < 3.2.1 - Reflected Cross-Site Scripting

EPSS 1.2%

Vexday Risk Score

18Low

SSVC decision (CISA)

Attend

PoC available → attend closely

CVSS —EPSS 1.2%KEV nãoPoC —Nuclei simMetasploit —Patch —

Lifecycle

27 Jun 2023Published on NVD

Recommendation: Plan a near-term fix — a public PoC already exists.

The KiviCare WordPress plugin before 3.2.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as administrator

Affected products

Unknown · KiviCare

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

http://packetstormsecurity.com/files/174895/WordPress-KiviCare-3.2.0-Cross-Site-Scripting.html https://wpscan.com/vulnerability/dc3a841d-a95b-462e-be4b-acaa44e77264