Lucene search
Krzysztof Zając (CERT PL)WPVDB-ID:55D23184-FC5A-4090-B079-142407B59B05HistoryNov 06, 2023 - 12:00 a.m.
WP-UserOnline < 2.88.3 - Unauthenticated Stored XSS
2023-11-0600:00:00
Krzysztof Zając (CERT PL)
wpscan.com
4
wordpress
plugin
cross-site scripting
unauthenticated
vulnerability
0.001 Low
EPSS
Percentile
30.3%
Description The plugin does not sanitise and escape the X-Forwarded-For header before outputting its content on the page, which allows unauthenticated users to perform Cross-Site Scripting attacks.
PoC
curl https://example.com -H 'X-Forwarded-For: ’ Then, as a high-privileged user, visit
/wp-admin/index.php?page=useronline
| CPE | Name | Operator | Version |
|---|---|---|---|
| eq | 2.88.3 |
Related
cvelist
cvelist
CVE-2023-5560 WP-UserOnline < 2.88.3 - Unauthenticated Stored XSS
2023-11-27 16:22:00
cve
cve
CVE-2023-5560
2023-11-27 17:15:08
prion
prion
Cross site scripting
2023-11-27 17:15:00
nvd
nvd
CVE-2023-5560
2023-11-27 17:15:08
wpexploit
wpexploit
WP-UserOnline < 2.88.3 - Unauthenticated Stored XSS
2023-11-06 00:00:00