PT-2023-18338 · WordPress · Badgeos
CVSS v3.1
5.4
Média
| Vetor | AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
BadgeOS plugin for WordPress versions up to, and including, 3.7.1.6
Description
The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the plugin's shortcode(s), allowing authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages. These scripts will execute whenever a user accesses an injected page.
Recommendations
For BadgeOS plugin for WordPress versions up to, and including, 3.7.1.6, update to a version higher than 3.7.1.6 to resolve the issue. As a temporary workaround, consider restricting access to the plugin's shortcode(s) to minimize the risk of exploitation. Additionally, limiting contributor-level and above permissions can help reduce the attack surface until a patch is applied.
Correção
XSS
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Badgeos