Lucene search
PRIOn knowledge basePRION:CVE-2023-1404HistoryJun 09, 2023 - 6:15 a.m.
Cross site scripting
2023-06-0906:15:00
PRIOn knowledge base
www.prio-n.com
4
wordpress
weaver show posts
cross-site scripting
vulnerability
profile display
injection
web scripts
nvd
authenticated attackers
contributor permissions
0.001 Low
EPSS
Percentile
40.5%
The Weaver Show Posts Plugin for WordPress is vulnerable to stored Cross-Site Scripting due to insufficient escaping of the profile display name in versions up to, and including, 1.6. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
| CPE | Name | Operator | Version |
|---|---|---|---|
| weaver_show_posts | le | 1.6 |
Related
cvelist
cvelist
CVE-2023-1404
2023-06-09 05:33:33
wpvulndb
wpvulndb
Weaver Show Posts < 1.7 - Contributor+ Stored Cross-Site Scripting
2023-04-01 00:00:00
nvd
nvd
CVE-2023-1404
2023-06-09 06:15:56
cve
cve
CVE-2023-1404
2023-06-09 06:15:56
zdt
zdt
wordfence
wordfence
packetstorm
packetstorm
WordPress Weaver Xtreme 5.0.7 / Weaver Show Posts 1.6 Cross Site Scripting
2023-04-18 00:00:00