Lucene search

K
patchstackBob MatyasPATCHSTACK:1A060B5D79CAECD0EE1FD79B0BD069A7
HistoryJul 15, 2024 - 12:00 a.m.

WordPress OpenPGP Form Encryption Plugin < 1.5.1 is vulnerable to Cross Site Scripting (XSS)

2024-07-1500:00:00
Bob Matyas
patchstack.com
2
wordpress openpgp form encryption
cross site scripting
vulnerable version < 1.5.1
cve-2024-3919
low severity

CVSS3

4.6

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

AI Score

6

Confidence

High

Software

OpenPGP Form Encryption

Type

Plugin

Vulnerable versions

< 1.5.1

Fixed in

1.5.1

OWASP Top 10

A7: Cross-Site Scripting (XSS)

Classification

Cross Site Scripting (XSS)

CVE

CVE-2024-3919

Patch priority

Low

CVSS severity

Low (6.5)

Developer

Claim ownership

PSID

357d35b3d36d

Credits

Bob Matyas

Required privilege

Contributor

Published

15 July, 2024

Vulnerability details

Remove and replace plugin Expand full details Have additional information or questions about this entry? Let us know.

Solution

This security issue has a low severity impact and is unlikely to be exploited.

Affected configurations

Vulners
Node
erik_l._arnesonopenpgp_form_encryptionRange<1.5.1
VendorProductVersionCPE
erik_l._arnesonopenpgp_form_encryption*cpe:2.3:a:erik_l._arneson:openpgp_form_encryption:*:*:*:*:*:*:*:*

CVSS3

4.6

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

AI Score

6

Confidence

High

Related for PATCHSTACK:1A060B5D79CAECD0EE1FD79B0BD069A7