PT-2023-6512 · WordPress · Wp Helper Lite
CVE-2023-0448
·
Publicado
2023-01-24
·
Atualizado
2023-02-01
CVSS v2.0
6.4
Média
| Vetor | AV:N/AC:L/Au:N/C:P/I:P/A:N |
Name of the Vulnerable Software and Affected Versions
WP Helper Lite versions prior to 4.3
Description
The issue arises from the plugin returning all GET parameters unsanitized in the response, leading to a reflected cross-site scripting vulnerability. This can be exploited by a remote attacker to conduct an inter-site scripting attack, potentially allowing them to inject malicious scripts into websites.
Recommendations
For versions prior to 4.3, update to version 4.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the plugin's functionality until a patch is applied. Avoid using the plugin with unsanitized GET parameters in the response until the issue is resolved.
Exploit
Correção
XSS
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Wp Helper Lite