CVE-2023-5620 Webpushr < 4.35.0 - Unauthenticated Stored XSS

2023-11-2716:22:07

WPScan

www.cve.org

cve-2023-5620

web push notifications

wordpress

plugin

unauthenticated

stored xss

vulnerability

0.0004 Low

EPSS

Percentile

14.2%

JSON

The Web Push Notifications WordPress plugin before 4.35.0 does not prevent visitors on the site from changing some of the plugin options, some of which may be used to conduct Stored XSS attacks.

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "Web Push Notifications",
    "versions": [
      {
        "status": "affected",
        "versionType": "semver",
        "version": "0",
        "lessThan": "4.35.0"
      }
    ],
    "defaultStatus": "unaffected",
    "collectionURL": "https://wordpress.org/plugins"
  }
]

References

wpscan.com/vulnerability/a03330c2-3ae0-404d-a114-33b18cc47666

0.0004 Low

EPSS

Percentile

14.2%

JSON

Related for CVELIST:CVE-2023-5620