CVE-2023-30876

2023-08-1709:15:12

CWE-79

[email protected]

web.nvd.nist.gov

cve-2023-30876

authentication

cross-site scripting

xss

vulnerability

wordpress

live search plugin

security

5.9 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L

0.0004 Low

EPSS

Percentile

14.2%

JSON

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Dave Ross Dave’s WordPress Live Search plugin <= 4.8.1 versions.

Affected configurations

Vulners

NVD

Node

dave_rossdave\'s_wordpress_live_searchRange≤4.8.1

CPENameOperatorVersion
davidmichaelross:dave\'s_wordpress_live_searchdavidmichaelross dave's wordpress live searchle4.8.1

CPE	Name	Operator	Version
davidmichaelross:dave\'s_wordpress_live_search	davidmichaelross dave's wordpress live search	le	4.8.1

CNA Affected

[
  {
    "collectionURL": "https://wordpress.org/plugins",
    "defaultStatus": "unaffected",
    "packageName": "daves-wordpress-live-search",
    "product": "Dave's WordPress Live Search",
    "vendor": "Dave Ross",
    "versions": [
      {
        "lessThanOrEqual": "4.8.1",
        "status": "affected",
        "version": "n/a",
        "versionType": "custom"
      }
    ]
  }
]

References

patchstack.com/database/vulnerability/daves-wordpress-live-search/wordpress-dave-s-wordpress-live-search-plugin-4-8-1-cross-site-scripting-xss-vulnerability?_s_id=cve