Lucene search

PatchstackCVE-2023-26529

HistoryApr 03, 2023 - 1:15 p.m.

CVE-2023-26529

2023-04-0313:15:07

CWE-79

Patchstack

web.nvd.nist.gov

cve-2023-26529

authentication

stored xss

cross-site scripting

dupeoff

plugin

nvd

CVSS3

5.9

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L

EPSS

0.001

Percentile

21.0%

JSON

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in DupeOff.Com DupeOff plugin <= 1.6 versions.

Affected configurations

Nvd

Vulners

Node

dupeoff_projectdupeoffRange≤1.6wordpress

VendorProductVersionCPE
dupeoff_projectdupeoff*cpe:2.3:a:dupeoff_project:dupeoff:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
dupeoff_project	dupeoff	*	cpe:2.3:a:dupeoff_project:dupeoff::::::wordpress::*

CNA Affected

[
  {
    "collectionURL": "https://wordpress.org/plugins",
    "defaultStatus": "unaffected",
    "packageName": "dupeoff",
    "product": "DupeOff",
    "vendor": "DupeOff.com",
    "versions": [
      {
        "lessThanOrEqual": "1.6",
        "status": "affected",
        "version": "n/a",
        "versionType": "custom"
      }
    ]
  }
]

References

patchstack.com/database/vulnerability/dupeoff/wordpress-dupeoff-plugin-1-6-cross-site-scripting-xss-vulnerability?_s_id=cve