CVE-2023-23723

2023-05-0212:15:22

CWE-79

[email protected]

web.nvd.nist.gov

cve-2023-23723

authorization

stored xss

cross-site scripting

winwar media

wp email capture

nvd

5.9 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L

0.0005 Low

EPSS

Percentile

17.7%

JSON

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Winwar Media WP Email Capture plugin <= 3.9.3 versions.

Affected configurations

Vulners

NVD

Node

winwar_mediawp_email_captureRange≤3.9.3

CPENameOperatorVersion
winwar:wp_email_capturewinwar wp email capturelt3.10

CPE	Name	Operator	Version
winwar:wp_email_capture	winwar wp email capture	lt	3.10

CNA Affected

[
  {
    "collectionURL": "https://wordpress.org/plugins",
    "defaultStatus": "unaffected",
    "packageName": "wp-email-capture",
    "product": "WP Email Capture",
    "vendor": "Winwar Media",
    "versions": [
      {
        "changes": [
          {
            "at": "3.10",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "3.9.3",
        "status": "affected",
        "version": "n/a",
        "versionType": "custom"
      }
    ]
  }
]

References

patchstack.com/database/vulnerability/wp-email-capture/wordpress-wordpress-email-marketing-plugin-wp-email-capture-plugin-3-9-3-cross-site-scripting-xss-vulnerability?_s_id=cve