PT-2023-15994 · WordPress · Resume Builder

Lana Codes · Published 2023-03-06 · Updated 2023-03-11 · CVE-2023-0078

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Resume Builder WordPress plugin versions 3.1.1 and earlier

Description The issue allows users with a role as low as subscriber to perform Stored XSS attacks against higher privilege users. This is due to the plugin not sanitizing and escaping some parameters related to Resume.

Recommendations For Resume Builder WordPress plugin versions 3.1.1 and earlier, update to a version later than 3.1.1 to resolve the issue. As a temporary workaround, consider restricting the use of the Resume feature to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2023-0078

Affected Products

Resume Builder

References · 5

• 🔥 https://wpscan.com/vulnerability/e667854f-56f8-4dbe-9573-6652a8aacc2c · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-0078 · Security Note
• https://osv.dev/vulnerability/CVE-2023-0078 · Vendor Advisory
• https://t.me/cibsecurity/59470 · Telegram Post
• https://t.me/cvenotify/45602 · Telegram Post