CVE-2023-34187

2023-08-3014:15:10

CWE-79

[email protected]

web.nvd.nist.gov

cve-2023-34187

authentication

stored xss

cross-site scripting

vulnerability

alan tien

plugin

nvd

5.9 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L

0.0004 Low

EPSS

Percentile

14.2%

JSON

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Alan Tien Call Now Icon Animate plugin <= 0.1.0 versions.

Affected configurations

Vulners

NVD

Node

alan_tiencall_now_icon_animateRange≤0.1.0

CPENameOperatorVersion
alantien:call_now_icon_animatealantien call now icon animatele0.1.0

CPE	Name	Operator	Version
alantien:call_now_icon_animate	alantien call now icon animate	le	0.1.0

CNA Affected

[
  {
    "collectionURL": "https://wordpress.org/plugins",
    "defaultStatus": "unaffected",
    "packageName": "call-now-icon-animate",
    "product": "Call Now Icon Animate",
    "vendor": "Alan Tien",
    "versions": [
      {
        "lessThanOrEqual": "0.1.0",
        "status": "affected",
        "version": "n/a",
        "versionType": "custom"
      }
    ]
  }
]

References

patchstack.com/database/vulnerability/call-now-icon-animate/wordpress-call-now-icon-animate-plugin-0-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve