PT-2024-12173 · Unknown+1 · Cream Magazine+3

László Radnai · Published 2024-03-26 · Updated 2024-03-27 · CVE-2023-28687

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Glaze Blog Lite versions 1.1.4 and earlier Fascinate version 1.0.8 Cream Blog version 2.1.3 Cream Magazine version 2.1.4

Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Reflected XSS attacks.

Recommendations For Glaze Blog Lite versions 1.1.4 and earlier, update to a version later than 1.1.4. For Fascinate version 1.0.8, update to a version later than 1.0.8. For Cream Blog version 2.1.3, update to a version later than 2.1.3. For Cream Magazine version 2.1.4, update to a version later than 2.1.4.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-28687

Affected Products

Cream Blog

Cream Magazine

Fascinate

Glaze Blog Lite

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2023-28687 · Security Note
• https://patchstack.com/database/vulnerability/glaze-blog-lite/wordpress-glaze-blog-lite-theme-1-1-4-cross-site-scripting-xss-vulnerability · Note
• https://patchstack.com/database/vulnerability/cream-blog/wordpress-cream-blog-theme-2-1-3-cross-site-scripting-xss-vulnerability?_s_id=cve · Note
• https://patchstack.com/database/vulnerability/fascinate/wordpress-fascinate-theme-1-0-8-cross-site-scripting-xss-vulnerability?_s_id=cve · Note
• https://twitter.com/CVEnew/status/1772722091566993714 · Twitter Post
• https://patchstack.com/database/vulnerability/cream-magazine/wordpress-cream-magazine-theme-2-1-4-cross-site-scripting-xss-vulnerability?_s_id=cve · Note