PT-2023-18645 · Unknown · Wpmobile.App

István Márton + 1 · Published 2023-03-23 · Updated 2023-03-28 · CVE-2023-22702

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions WPMobile.App versions <= 11.13

Description A Cross-Site Scripting (XSS) vulnerability has been discovered in the WPMobile.App plugin for Android and iOS mobile applications, affecting versions up to and including 11.13. This issue allows for XSS attacks when authentication is set to contributor or higher.

Recommendations For versions <= 11.13, update to a version higher than 11.13 to resolve the issue. As a temporary workaround, consider restricting access to sensitive areas of the application to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-22702

Affected Products

Wpmobile.App

References · 5

• https://osv.dev/vulnerability/CVE-2023-22702 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-22702 · Security Note
• https://t.me/thebugbountyhunter/7166 · Telegram Post
• https://patchstack.com/database/vulnerability/wpappninja/wordpress-wpmobile-app-android-and-ios-mobile-application-plugin-11-13-cross-site-scripting-xss-vulnerability?_s_id=cve · Note
• https://t.me/cibsecurity/60575 · Telegram Post