PT-2023-31793 · WordPress · Simply Excerpts

Niclo · Publicado 2023-12-04 · Atualizado 2023-12-07 · CVE-2023-5137

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Média

Vetor base

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Simply Excerpts WordPress plugin version 1.4 and earlier

Description The Simply Excerpts WordPress plugin does not sanitize and escape some fields in the plugin settings, which could allow high-privilege users such as an administrator to inject arbitrary web scripts even when the unfiltered html capability is disallowed, for example in a multisite setup.

Recommendations For Simply Excerpts WordPress plugin version 1.4 and earlier, update to a version that sanitizes and escapes fields in the plugin settings to prevent arbitrary web script injection. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2023-5137

Produtos afetados

Simply Excerpts

Referências · 7

• 🔥 https://wpscan.com/vulnerability/79b79e9c-ea4f-4188-a1b5-61dda0b5d434 · Exploit
• https://osv.dev/vulnerability/CVE-2023-5137 · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/1731820191162499494 · Publicação no Twitter
• https://t.me/cvenotify/62810 · Publicação no Telegram
• https://twitter.com/CVEnew/status/1731789880156422618 · Publicação no Twitter
• https://t.me/cvenotify/62191 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-5137 · Nota de Segurança