PT-2023-16260 · WordPress · Article Directory Wordpress Plugin

Shreya Pohekar · Publicado 2023-04-10 · Atualizado 2023-04-14 · CVE-2023-0422

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Média

Vetor base

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Article Directory WordPress plugin versions prior to 1.4

Description The issue arises from improper sanitization of the publish terms text setting, which can be exploited to conduct Stored XSS attacks, particularly in multisite environments. This could potentially allow administrators to execute malicious scripts.

Recommendations For Article Directory WordPress plugin versions prior to 1.4, update to version 1.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the administration panel to minimize the risk of exploitation. Avoid using the publish terms text setting in the administration panel until the issue is resolved.

Exploit

Correção

Identificadores relacionados

CVE-2023-0422

Produtos afetados

Article Directory Wordpress Plugin

Referências · 3

• 🔥 https://wpscan.com/vulnerability/d57f2fb2-5251-4069-8c9a-a4af269c5e62 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-0422 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-0422 · Aviso do Fabricante