Lucene search

K
cvelistPatchstackCVELIST:CVE-2023-38000
HistoryOct 13, 2023 - 9:55 a.m.

CVE-2023-38000 Auth. Stored Cross-Site Scripting (XSS) vulnerability in WordPress core and Gutenberg plugin via Navigation Links Block

2023-10-1309:55:54
CWE-79
Patchstack
www.cve.org
cross-site scripting
wordpress core
gutenberg plugin
navigation links block
cve-2023-38000
vulnerability

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

6.1 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

42.4%

Auth. Stored (contributor+) Cross-Site Scripting (XSS) vulnerability in WordPress core 6.3 through 6.3.1, from 6.2 through 6.2.2, from 6.1 through 6.1.3, from 6.0 through 6.0.5, from 5.9 through 5.9.7 and Gutenberg plugin <= 16.8.0 versions.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "WordPress",
    "vendor": "WordPress.org",
    "versions": [
      {
        "changes": [
          {
            "at": "6.3.2",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "6.3.1",
        "status": "affected",
        "version": "6.3",
        "versionType": "custom"
      },
      {
        "changes": [
          {
            "at": "6.2.3",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "6.2.2",
        "status": "affected",
        "version": "6.2",
        "versionType": "custom"
      },
      {
        "changes": [
          {
            "at": "6.1.4",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "6.1.3",
        "status": "affected",
        "version": "6.1",
        "versionType": "custom"
      },
      {
        "changes": [
          {
            "at": "6.0.6",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "6.0.5",
        "status": "affected",
        "version": "6.0",
        "versionType": "custom"
      },
      {
        "changes": [
          {
            "at": "5.9.8",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "5.9.7",
        "status": "affected",
        "version": "5.9",
        "versionType": "custom"
      }
    ]
  },
  {
    "collectionURL": "https://wordpress.org/plugins",
    "defaultStatus": "unaffected",
    "packageName": "gutenberg",
    "product": "Gutenberg",
    "vendor": "Gutenberg Team",
    "versions": [
      {
        "changes": [
          {
            "at": "16.8.1",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "16.8.0",
        "status": "affected",
        "version": "n/a",
        "versionType": "custom"
      }
    ]
  }
]

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

6.1 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

42.4%