6.4
CVE-2023-3412
- EPSS 0.09%
- Veröffentlicht 27.06.2023 04:15:10
- Zuletzt bearbeitet 13.01.2025 18:27:44
- Quelle security@wordfence.com
- CVE-Watchlists
- Unerledigt
LoginImage Map Pro – Drag-and-drop Builder for Interactive Images – Lite <= 1.0.0 - Missing Authorization to Stored Cross-Site Scripting
The Image Map Pro – Drag-and-drop Builder for Interactive Images – Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.0.0. This is due to a missing capability check on the ajax_store_save() function. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to modify plugin settings and inject malicious web scripts.
Mögliche Gegenmaßnahme
Image Map Pro – Drag-and-drop Builder for Interactive Images – Lite: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt
Image Map Pro – Drag-and-drop Builder for Interactive Images – Lite
Version
* - 1.0.0
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Webcraftplugins ≫ Image Map Pro SwEditionlite SwPlatformwordpress Version <= 1.0.0
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.09% | 0.255 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 5.4 | 2.3 | 2.7 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
|
| security@wordfence.com | 6.4 | 3.1 | 2.7 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
|