4.8
CVE-2023-1469
- EPSS 0.16%
- Veröffentlicht 17.03.2023 13:15:10
- Zuletzt bearbeitet 21.11.2024 07:39:15
- Quelle security@wordfence.com
- CVE-Watchlists
- Unerledigt
LoginWP Express Checkout <= 2.2.8 - Authenticated (Admin+) Stored Cross-Site Scripting via pec_coupon[code]
The WP Express Checkout plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘pec_coupon[code]’ parameter in versions up to, and including, 2.2.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with administrator-level access to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Note: This can potentially be exploited by lower-privileged users if the `Admin Dashboard Access Permission` setting it set for those users to access the dashboard.
Mögliche Gegenmaßnahme
WP Express Checkout (Fast Payments via PayPal & Stripe): Update to version 2.2.9, or a newer patched version
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt
WP Express Checkout (Fast Payments via PayPal & Stripe)
Version
2.2.8
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Tipsandtricks-hq ≫ Wp Express Checkout SwPlatformwordpress Version < 2.2.9
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.16% | 0.368 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 4.8 | 1.7 | 2.7 |
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
|
| security@wordfence.com | 4.4 | 1.3 | 2.7 |
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
|