Lucene search
WPScanCVELIST:CVE-2023-0270HistoryFeb 13, 2023 - 2:32 p.m.
CVE-2023-0270 YaMaps for WordPress Plugin < 0.6.26 - Contributor+ Stored XSS
2023-02-1314:32:02
WPScan
www.cve.org
cve-2023-0270
yamaps
wordpress plugin
stored xss
shortcode attributes
cross-site scripting
0.001 Low
EPSS
Percentile
23.3%
The YaMaps for WordPress Plugin WordPress plugin before 0.6.26 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
CNA Affected
[
{
"vendor": "Unknown",
"product": "YaMaps for WordPress Plugin",
"versions": [
{
"status": "affected",
"versionType": "custom",
"version": "0",
"lessThan": "0.6.26"
}
],
"defaultStatus": "unaffected",
"collectionURL": "https://wordpress.org/plugins"
}
]Related
prion
prion
Cross site scripting
2023-02-13 15:15:00
wpvulndb
wpvulndb
YaMaps for WordPress Plugin < 0.6.26 - Contributor+ Stored XSS
2023-01-17 00:00:00
nvd
nvd
CVE-2023-0270
2023-02-13 15:15:21
cve
cve
CVE-2023-0270
2023-02-13 15:15:21
wpexploit
wpexploit
YaMaps for WordPress Plugin < 0.6.26 - Contributor+ Stored XSS
2023-01-17 00:00:00