Lucene search

MinhtuanactPATCHSTACK:8A5994B8B67D6A85853B1FC1418F779F

HistoryApr 06, 2023 - 12:00 a.m.

WordPress Product Catalog Simple Plugin <= 1.6.17 is vulnerable to Cross Site Scripting (XSS)

2023-04-0600:00:00

minhtuanact

patchstack.com

wordpress catalog plugin

vulnerability

cross site scripting

patch available

medium severity

CVSS3

7.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

AI Score

5.6

Confidence

High

JSON

Software

Product Catalog Simple

Type

Plugin

Vulnerable versions

<= 1.6.17

Fixed in

1.7.0

OWASP Top 10

A7: Cross-Site Scripting (XSS)

Classification

Cross Site Scripting (XSS)

CVE

CVE-2023-29388

Patch priority

Medium

CVSS severity

Medium (7.1)

Developer

Claim ownership

PSID

48939529292d

Credits

minhtuanact

Required privilege

Unauthenticated

Published

6 April, 2023

Expand full details Have additional information or questions about this entry? Let us know.

Solution

We advise to mitigate or resolve the vulnerability immediately.

Affected configurations

Vulners

Node

implecodeproduct_catalog_simpleRange≤1.6.17wordpress

VendorProductVersionCPE
implecodeproduct_catalog_simple*cpe:2.3:a:implecode:product_catalog_simple:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
implecode	product_catalog_simple	*	cpe:2.3:a:implecode:product_catalog_simple::::::wordpress::*

References

wordpress.org/plugins/post-type-x/#developers

www.cve.org/CVERecord?id=CVE-2023-29388