CVE-2023-1020

2023-04-2419:15:09

[email protected]

web.nvd.nist.gov

cve-2023-1020

wordpress

plugin

sql injection

unauthenticated users

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

0.053 Low

EPSS

Percentile

93.1%

JSON

The Steveas WP Live Chat Shoutbox WordPress plugin through 1.4.2 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.

Affected configurations

Vulners

NVD

Node

wp_live_chat_shoutbox_projectwp_live_chat_shoutboxRange≤1.4.2

VendorProductVersionCPE
wp_live_chat_shoutbox_projectwp_live_chat_shoutbox*cpe:2.3:a:wp_live_chat_shoutbox_project:wp_live_chat_shoutbox:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
wp_live_chat_shoutbox_project	wp_live_chat_shoutbox	*	cpe:2.3:a:wp_live_chat_shoutbox_project:wp_live_chat_shoutbox::::::::

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "Steveas WP Live Chat Shoutbox",
    "versions": [
      {
        "status": "affected",
        "versionType": "custom",
        "version": "0",
        "lessThanOrEqual": "1.4.2"
      }
    ],
    "defaultStatus": "affected",
    "collectionURL": "https://wordpress.org/plugins"
  }
]