PT-2023-20083 · Gopi Ramasamy · Wp Tell A Friend Popup Form Plugin

Yuyudhn · CVE-2023-25465 · Publicado 2023-09-04 · Atualizado 2023-09-06

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Média

Vetor base

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Gopi Ramasamy wp tell a friend popup form plugin versions <= 7.1

Description The issue is related to an Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability. This means that an attacker with administrative access can inject malicious scripts into the application, potentially affecting other users. The vulnerability is present in the wp tell a friend popup form plugin.

Recommendations For Gopi Ramasamy wp tell a friend popup form plugin versions <= 7.1, consider disabling the plugin until a patch is available to prevent potential exploitation. As a temporary workaround, restrict access to the plugin's functionality to minimize the risk of XSS attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2023-25465

Produtos afetados

Wp Tell A Friend Popup Form Plugin

Referências · 6

• https://twitter.com/VulmonFeeds/status/1698679772203602373 · Publicação no Twitter
• https://t.me/cibsecurity/69761 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-25465 · Aviso do Fabricante
• https://patchstack.com/database/vulnerability/wp-tell-a-friend-popup-form/wordpress-wp-tell-a-friend-popup-form-plugin-7-1-cross-site-scripting-xss-vulnerability?_s_id=cve · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-25465 · Nota de Segurança
• https://twitter.com/CVEnew/status/1698641312088834257 · Publicação no Twitter