Lucene search

[email protected]NVD:CVE-2023-40674

HistoryNov 30, 2023 - 1:15 p.m.

CVE-2023-40674

2023-11-3013:15:07

CWE-79

[email protected]

web.nvd.nist.gov

cve-2023-40674

web page generation

stored xss

link cloaking

product displays

affiliate link management

5.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

0.0004 Low

EPSS

Percentile

14.0%

JSON

Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Lasso Simple URLs – Link Cloaking, Product Displays, and Affiliate Link Management allows Stored XSS.This issue affects Simple URLs – Link Cloaking, Product Displays, and Affiliate Link Management: from n/a through 118.

Affected configurations

NVD

Node

getlassosimple_urlsRange≤118wordpress

References

patchstack.com/database/vulnerability/simple-urls/wordpress-simple-urls-plugin-117-shortcode-cross-site-scripting-xss-vulnerability?_s_id=cve