Lucene search
Alex SanfordWPVDB-ID:AA380524-031D-4E49-9D0B-96E62D54557FHistoryOct 16, 2023 - 12:00 a.m.
Awesome Support < 6.1.5 - Reflected Cross-Site Scripting
2023-10-1600:00:00
Alex Sanford
wpscan.com
4
plugin security vulnerability
reflected cross-site scripting
admin user risk
web application security
Description The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
PoC
Visit the following URL as an admin user, with any valid ticket ID. Press the access key combination to trigger XSS (e.g. Ctrl+Alt+X on Firefox on MacOS). https://example.com/wp-admin/post.php?post=TICKET_ID"+accessKey%3DX+onclick%3Dalert(%2Fxss%2F)+"&action;=edit
| CPE | Name | Operator | Version |
|---|---|---|---|
| eq | 6.1.5 |
Related
cve
cve
CVE-2023-5354
2023-11-06 21:15:09
cvelist
cvelist
CVE-2023-5354 Awesome Support < 6.1.5 - Reflected Cross-Site Scripting
2023-11-06 20:40:28
nvd
nvd
CVE-2023-5354
2023-11-06 21:15:09
prion
prion
Cross site scripting
2023-11-06 21:15:00
wpexploit
wpexploit
Awesome Support < 6.1.5 - Reflected Cross-Site Scripting
2023-10-16 00:00:00
5.1 Medium
AI Score
Confidence
High
0.0005 Low
EPSS
Percentile
17.0%
Related for WPVDB-ID:AA380524-031D-4E49-9D0B-96E62D54557F