PT-2023-6512 · WordPress · Wp Helper Lite

Published 2023-01-24 · Updated 2023-02-01 · CVE-2023-0448

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions WP Helper Lite versions prior to 4.3

Description The issue arises from the plugin returning all GET parameters unsanitized in the response, leading to a reflected cross-site scripting vulnerability. This can be exploited by a remote attacker to conduct an inter-site scripting attack, potentially allowing them to inject malicious scripts into websites.

Recommendations For versions prior to 4.3, update to version 4.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the plugin's functionality until a patch is applied. Avoid using the plugin with unsanitized GET parameters in the response until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2023-07259

CVE-2023-0448

Affected Products

Wp Helper Lite

References · 5

• 🔥 https://tenable.com/security/research/tra-2023-3 · Exploit
• https://osv.dev/vulnerability/CVE-2023-0448 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-07259 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-0448 · Security Note
• https://github.com/advisories/GHSA-33wx-8m27-jwj5 · Note