PT-2023-31793 · WordPress · Simply Excerpts

Niclo · Published 2023-12-04 · Updated 2023-12-07 · CVE-2023-5137

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Simply Excerpts WordPress plugin version 1.4 and earlier

Description The Simply Excerpts WordPress plugin does not sanitize and escape some fields in the plugin settings, which could allow high-privilege users such as an administrator to inject arbitrary web scripts even when the unfiltered html capability is disallowed, for example in a multisite setup.

Recommendations For Simply Excerpts WordPress plugin version 1.4 and earlier, update to a version that sanitizes and escapes fields in the plugin settings to prevent arbitrary web script injection. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-5137

Affected Products

Simply Excerpts

References · 7

• 🔥 https://wpscan.com/vulnerability/79b79e9c-ea4f-4188-a1b5-61dda0b5d434 · Exploit
• https://osv.dev/vulnerability/CVE-2023-5137 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-5137 · Security Note
• https://twitter.com/VulmonFeeds/status/1731820191162499494 · Twitter Post
• https://t.me/cvenotify/62810 · Telegram Post
• https://twitter.com/CVEnew/status/1731789880156422618 · Twitter Post
• https://t.me/cvenotify/62191 · Telegram Post