Lucene search
WpvulndbWPVDB-ID:E71E421E-D38C-46F4-BCDC-6ACBDF1D1D49HistoryJan 12, 2023 - 12:00 a.m.
Login with Phone Number < 1.4.2 - Reflected Cross-Site Scripting
2023-01-1200:00:00
wpscan.com
12
phone number
cross-site scripting
plugin vulnerability
reflected
high privilege users
admin
id parameter
sanitisation
escape.
0.062 Low
EPSS
Percentile
93.6%
The plugin does not sanitise and escape the ID parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
PoC
https://example.com/wp-admin/admin-ajax.php?action=lwp_forgot_password&ID;=
| CPE | Name | Operator | Version |
|---|---|---|---|
| login-with-phone-number | lt | 1.4.2 |
Related
cve
cve
CVE-2023-23492
2023-01-20 19:15:18
nvd
nvd
CVE-2023-23492
2023-01-20 19:15:18
prion
prion
Sql injection
2023-01-20 19:15:00
nuclei
nuclei
Login with Phone Number - Cross-Site Scripting
2023-03-05 13:42:10
openvas
openvas
WordPress Login with Phone Number Plugin < 1.4.2 XSS Vulnerability
2023-08-28 00:00:00
wpexploit
wpexploit
Login with Phone Number < 1.4.2 - Reflected Cross-Site Scripting
2023-01-12 00:00:00
cvelist
cvelist
CVE-2023-23492
2023-01-20 00:00:00