PT-2023-19285 · Oceanwp · Oceanwp Ocean Extra+1

Rafshanzani Suhada · Published 2023-04-06 · Updated 2023-04-12 · CVE-2023-23891

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions OceanWP Ocean Extra plugin versions <= 2.1.1

Description The issue is related to a Stored Cross-Site Scripting (XSS) vulnerability that requires authentication with contributor or higher privileges. It affects the OceanWP Ocean Extra plugin when the OceanWP theme is installed and activated.

Recommendations For OceanWP Ocean Extra plugin versions <= 2.1.1, update to a version higher than 2.1.1 to resolve the issue. As a temporary workaround, consider restricting access to the plugin's functionality that requires contributor or higher privileges until a patch is available.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-23891

Affected Products

Oceanwp

Oceanwp Ocean Extra

References · 4

• https://osv.dev/vulnerability/CVE-2023-23891 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-23891 · Security Note
• https://patchstack.com/database/vulnerability/ocean-extra/wordpress-ocean-extra-plugin-2-1-1-cross-site-scripting-xss-vulnerability?_s_id=cve · Note
• https://t.me/cibsecurity/61559 · Telegram Post