CVE-2023-1804

Product Catalog Feed by PixelYourSite < 2.1.1 - Reflected XSS

CVSS 6.1 MEDIUMEPSS 0.5%CWE-79

Vexday Risk Score

13Bajo

Decisión SSVC (CISA)

Track

Sin señal de explotación → monitorear

CVSS 6.1EPSS 0.5%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

02 may 2023Publicada en NVD

Recomendación: Monitorear — sin señal de explotación por ahora.

The Product Catalog Feed by PixelYourSite WordPress plugin before 2.1.1 does not sanitise and escape the edit parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as administrators.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Productos afectados

Unknown · Product Catalog Feed by PixelYourSite

Referencias

https://wpscan.com/vulnerability/55b28fa6-a54f-4365-9d59-f9e331c1e11b