Lucene search
PRIOn knowledge basePRION:CVE-2023-3169HistorySep 11, 2023 - 8:15 p.m.
Cross site scripting
2023-09-1120:15:00
PRIOn knowledge base
www.prio-n.com
13
cross-site scripting
wordpress plugin
tagdiv composer
vulnerability
unauthenticated users
stored xss attacks
nvd
0.001 Low
EPSS
Percentile
30.2%
The tagDiv Composer WordPress plugin before 4.2, used as a companion by the Newspaper and Newsmag themes from tagDiv, does not have authorisation in a REST route and does not validate as well as escape some parameters when outputting them back, which could allow unauthenticated users to perform Stored Cross-Site Scripting attacks.
| CPE | Name | Operator | Version |
|---|---|---|---|
| tagdiv_composer | lt | 4.2 |
Related
hivepro
hivepro
Balada Injector A Large-Scale Malware Campaign Targeting WordPress
2023-10-14 12:27:23
wpvulndb
wpvulndb
tagDiv Composer < 4.2 - Unauthenticated Stored XSS
2023-08-17 00:00:00
thn
thn
Over 17,000 WordPress Sites Compromised by Balada Injector in September 2023
2023-10-11 12:41:00
cve
cve
CVE-2023-3169
2023-09-11 20:15:09
cvelist
cvelist
CVE-2023-3169 tagDiv Composer < 4.2 - Unauthenticated Stored XSS
2023-09-11 19:46:07
wpexploit
wpexploit
tagDiv Composer < 4.2 - Unauthenticated Stored XSS
2023-08-17 00:00:00
nvd
nvd
CVE-2023-3169
2023-09-11 20:15:09
wordfence
wordfence