Lucene search

K
patchstackEmili CastellsPATCHSTACK:26FD7E7AD491D41FF92EBCE26986A8C6
HistoryApr 25, 2024 - 12:00 a.m.

WordPress Annual Archive Plugin <= 1.6.0 is vulnerable to Cross Site Scripting (XSS)

2024-04-2500:00:00
Emili Castells
patchstack.com
1
wordpress annual archive plugin
cross site scripting
software
vulnerability
owasp top 10
cve-2024-33598
low severity

CVSS3

5.9

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L

AI Score

6.6

Confidence

High

Software

Annual Archive

Type

Plugin

Vulnerable versions

<= 1.6.0

Fixed in

N/A

OWASP Top 10

A3: Injection

Classification

Cross Site Scripting (XSS)

CVE

CVE-2024-33598

Patch priority

Low

CVSS severity

Low (5.9)

Developer

Claim ownership

PSID

173a2a10ba4f

Credits

Emili Castells Emili Castells

Required privilege

Administrator

Published

25 April, 2024

Remove and replace plugin Expand full details Have additional information or questions about this entry? Let us know.

Solution

This security issue has a low severity impact and is unlikely to be exploited.

Affected configurations

Vulners
Node
twinpicturesannual_archiveRange1.6.0wordpress
VendorProductVersionCPE
twinpicturesannual_archive*cpe:2.3:a:twinpictures:annual_archive:*:*:*:*:*:wordpress:*:*

CVSS3

5.9

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L

AI Score

6.6

Confidence

High

Related for PATCHSTACK:26FD7E7AD491D41FF92EBCE26986A8C6