Lucene search

[email protected]CVE-2023-35878

HistoryJun 20, 2023 - 8:15 a.m.

CVE-2023-35878

2023-06-2008:15:09

CWE-79

[email protected]

web.nvd.nist.gov

cve-2023-35878

auth

admin

stored xss

cross-site scripting

vadym k. extra user details plugin

nvd

5.9 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L

5.2 Medium

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

16.1%

JSON

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Vadym K. Extra User Details plugin <= 0.5 versions.

Affected configurations

Vulners

NVD

Node

vadym_k.extra_user_detailsRange≤0.5

CPENameOperatorVersion
extra_user_details_project:extra_user_detailsextra user details project extra user detailsle0.5

CPE	Name	Operator	Version
extra_user_details_project:extra_user_details	extra user details project extra user details	le	0.5

CNA Affected

[
  {
    "collectionURL": "https://wordpress.org/plugins",
    "defaultStatus": "unaffected",
    "packageName": "extra-user-details",
    "product": "Extra User Details",
    "vendor": "Vadym K.",
    "versions": [
      {
        "changes": [
          {
            "at": "0.5.1",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "0.5",
        "status": "affected",
        "version": "n/a",
        "versionType": "custom"
      }
    ]
  }
]

References

patchstack.com/database/vulnerability/extra-user-details/wordpress-extra-user-details-plugin-0-5-cross-site-scripting-xss-vulnerability?_s_id=cve