Lucene search

K
wpvulndbWpvulndbWPVDB-ID:CD0237CD-FE66-4B48-A8E1-C5705287D1D0
HistoryMay 03, 2024 - 12:00 a.m.

Pricing Table by Supsystic < 1.9.13 - Admin+ Content Injection

2024-05-0300:00:00
wpscan.com
7
wordpress
supsystic
pricing table
content injection
vulnerability
admin-level access

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

AI Score

7.2

Confidence

Low

EPSS

0

Percentile

9.0%

Description The Pricing Table by Supsystic plugin for WordPress is vulnerable to content injection in all versions up to, and including, 1.9.12. This makes it possible for authenticated attackers, with admin-level access and above, to inject arbitrary content. This is not a security issue by default, however, administrators can grant lower-level users access to functionality that makes this a security issue.

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

AI Score

7.2

Confidence

Low

EPSS

0

Percentile

9.0%

Related for WPVDB-ID:CD0237CD-FE66-4B48-A8E1-C5705287D1D0