Lucene search
Rio DarmawanWPEX-ID:B0F8713F-54B2-4AB2-A475-60A1692A50E9HistoryMar 28, 2023 - 12:00 a.m.
MS-Reviews <= 1.5 - Subscriber+ Stored XSS
2023-03-2800:00:00
Rio Darmawan
38
stored xss
frontend exploit
ms-reviews vulnerability
0.001 Low
EPSS
Percentile
23.7%
The plugin does not sanitise and escape reviews, which could allow users any authenticated users, such as Subscribers to perform Stored Cross-Site Scripting attacks
As a subscriber, submit a review (a page/post with [ms_reviews] embed) with the following payload: <script>alert(/XSS/)</script>
The XSS will be triggered when anyone (including an admin) will view the page/post in the frontendRelated
cve
cve
CVE-2023-0424
2023-04-24 19:15:08
wpvulndb
wpvulndb
MS-Reviews <= 1.5 - Subscriber+ Stored XSS
2023-03-28 00:00:00
prion
prion
Cross site scripting
2023-04-24 19:15:00
cvelist
cvelist
CVE-2023-0424 MS-Reviews <= 1.5 - Subscriber+ Stored XSS
2023-04-24 18:30:57
nvd
nvd
CVE-2023-0424
2023-04-24 19:15:08
wordfence
wordfence