PT-2023-20083 · Gopi Ramasamy · Wp Tell A Friend Popup Form Plugin

Yuyudhn · Published 2023-09-04 · Updated 2023-09-06 · CVE-2023-25465

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Gopi Ramasamy wp tell a friend popup form plugin versions <= 7.1

Description The issue is related to an Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability. This means that an attacker with administrative access can inject malicious scripts into the application, potentially affecting other users. The vulnerability is present in the wp tell a friend popup form plugin.

Recommendations For Gopi Ramasamy wp tell a friend popup form plugin versions <= 7.1, consider disabling the plugin until a patch is available to prevent potential exploitation. As a temporary workaround, restrict access to the plugin's functionality to minimize the risk of XSS attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-25465

Affected Products

Wp Tell A Friend Popup Form Plugin

References · 6

• https://osv.dev/vulnerability/CVE-2023-25465 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-25465 · Security Note
• https://twitter.com/VulmonFeeds/status/1698679772203602373 · Twitter Post
• https://t.me/cibsecurity/69761 · Telegram Post
• https://patchstack.com/database/vulnerability/wp-tell-a-friend-popup-form/wordpress-wp-tell-a-friend-popup-form-plugin-7-1-cross-site-scripting-xss-vulnerability?_s_id=cve · Note
• https://twitter.com/CVEnew/status/1698641312088834257 · Twitter Post