CVE-2023-7246 System Dashboard < 2.8.10 - XSS via Header Injection

2024-03-2005:00:02

WPScan

github.com

cve-2023-7246

system dashboard

wordpress

xss

header injection

administrators

cross-site scripting

AI Score

6.1

Confidence

High

SSVC

Exploitation

poc

Automatable

Technical Impact

partial

JSON

The System Dashboard WordPress plugin before 2.8.10 does not sanitize and escape some parameters, which could allow administrators in multisite WordPress configurations to perform Cross-Site Scripting attacks

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:bowo:system_dashboard:*:*:*:*:*:wordpress:*:*"
    ],
    "vendor": "bowo",
    "product": "system_dashboard",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "2.8.10",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unknown"
  }
]