CVE-2023-23863

2023-05-0908:15:08

CWE-79

[email protected]

web.nvd.nist.gov

cve-2023-23863

nvd

vulnerability

xss

treepress

plugin

security

5.9 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L

0.0005 Low

EPSS

Percentile

17.6%

JSON

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Black and White Digital Ltd TreePress – Easy Family Trees & Ancestor Profiles plugin <= 2.0.22 versions.

Affected configurations

Vulners

NVD

Node

black_and_white_digital_ltdtreepress_–_easy_family_trees_\&_ancestor_profilesRange≤2.0.22

CPENameOperatorVersion
blackandwhitedigital:treepressblackandwhitedigital treepresslt3.0.0

CPE	Name	Operator	Version
blackandwhitedigital:treepress	blackandwhitedigital treepress	lt	3.0.0

CNA Affected

[
  {
    "collectionURL": "https://wordpress.org/plugins",
    "defaultStatus": "unaffected",
    "packageName": "treepress",
    "product": "TreePress – Easy Family Trees & Ancestor Profiles",
    "vendor": "Black and White Digital Ltd",
    "versions": [
      {
        "changes": [
          {
            "at": "3.0.0",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "2.0.22",
        "status": "affected",
        "version": "n/a",
        "versionType": "custom"
      }
    ]
  }
]

References

patchstack.com/database/vulnerability/treepress/wordpress-treepress-easy-family-trees-ancestor-profiles-plugin-2-0-22-cross-site-scripting-xss-vulnerability?_s_id=cve