PT-2023-21254 · David F. Carr · Rsvpmaker Plugin

Muhammad Arsalan Diponegoro · Published 2023-09-26 · Updated 2023-09-29 · CVE-2023-27616

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions David F. Carr RSVPMaker plugin versions <= 10.6.6

Description The issue is an Unauth. Stored Cross-Site Scripting (XSS) vulnerability. This means that an attacker can inject malicious scripts into the application, which can then be executed by other users. No information is provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited.

Recommendations For David F. Carr RSVPMaker plugin versions <= 10.6.6, update to a version higher than 10.6.6 to resolve the issue. As a temporary workaround, consider restricting access to the plugin until a patch is available. Avoid using the plugin for sensitive operations until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-27616

Affected Products

Rsvpmaker Plugin

References · 5

• https://osv.dev/vulnerability/CVE-2023-27616 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-27616 · Security Note
• https://twitter.com/CVEnew/status/1706906544955437233 · Twitter Post
• https://twitter.com/cracbot/status/1707273978572931472 · Twitter Post
• https://patchstack.com/database/vulnerability/rsvpmaker/wordpress-rsvpmaker-plugin-10-6-4-cross-site-scripting-xss-vulnerability-2?_s_id=cve · Note