CVE-2023-23670

2023-03-3011:15:06

CWE-79

Patchstack

web.nvd.nist.gov

cve-2023-23670

auth

contributor

xss

vulnerability

team heateor

fancy comments

wordpress plugin

nvd

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

EPSS

0.001

Percentile

21.0%

JSON

Auth. (contributor+) Cross-Site Scripting (XSS) vulnerability in Team Heateor Fancy Comments WordPress plugin <= 1.2.10 versions.

Affected configurations

Nvd

Vulners

Node

heateorfancy_commentsRange<1.2.11wordpress

VendorProductVersionCPE
heateorfancy_comments*cpe:2.3:a:heateor:fancy_comments:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
heateor	fancy_comments	*	cpe:2.3:a:heateor:fancy_comments::::::wordpress::*

CNA Affected

[
  {
    "collectionURL": "https://wordpress.org/plugins",
    "defaultStatus": "unaffected",
    "packageName": "fancy-facebook-comments",
    "product": "Fancy Comments WordPress",
    "vendor": "Team Heateor",
    "versions": [
      {
        "changes": [
          {
            "at": "1.2.11",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "1.2.10",
        "status": "affected",
        "version": "n/a",
        "versionType": "custom"
      }
    ]
  }
]

References

patchstack.com/database/vulnerability/fancy-facebook-comments/wordpress-fancy-comments-wordpress-plugin-1-2-10-cross-site-scripting-xss-vulnerability?_s_id=cve