CVE-2023-0448

🗓️ 24 Jan 2023 00:00:00Reported by tenableType

cve🔗 web.nvd.nist.gov👁 86 Views🌐 WEB

The WP Helper Lite WordPress plugin has reflected cross-site scripting vulnerability

Reporter	Title	Published	Views	Family All 16
BDU FSTEC	The vulnerability of the WP Helper Lite plugin of the WordPress content management system arises from the lack of measures taken to protect the website’s structure. This allows attackers to carry out XSS attacks.	30 Oct 202300:00	–	bdu_fstec
Circl	CVE-2023-0448	24 Oct 202404:50	–	circl
CNNVD	WordPress plugin WP Helper Lite 跨站脚本漏洞	26 Jan 202300:00	–	cnnvd
Cvelist	CVE-2023-0448	24 Jan 202300:00	–	cvelist
Nuclei	WP Helper Lite < 4.3 - Cross-Site Scripting	28 Jun 202615:08	–	nuclei
NVD	CVE-2023-0448	26 Jan 202321:18	–	nvd
OpenVAS	WordPress WP Helper Lite Plugin < 4.3 XSS Vulnerability	28 Aug 202300:00	–	openvas
OSV	CVE-2023-0448	26 Jan 202321:18	–	osv
Patchstack	WordPress WP Helper Premium Plugin < 4.3 is vulnerable to Cross Site Scripting (XSS)	24 Jan 202300:00	–	patchstack
Prion	Cross site scripting	26 Jan 202321:18	–	prion

NVD

Node

matbao wp_helper_premiumRange<4.3wordpress

[
  {
    "vendor": "n/a",
    "product": "WP Helper Lite Wordpress Plugin",
    "versions": [
      {
        "version": "All versions prior to version 4.3",
        "status": "affected"
      }
    ]
  }
]

Source	Link
tenable	www.tenable.com/security/research/tra-2023-3

Parameter	Position	Path	Description	CWE
a	query param	/wp-admin/admin-ajax.php	Reflected XSS due to unsanitized GET parameters echoed back in AJAX response (CWE-79).	CWE-79

17 Jun 2026 05:25Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.16.1

EPSS0.44513

SSVC

CWE-79