CVE-2023-4284

EPSS 7.92%
Veröffentlicht 04.09.2023 12:15:10
Zuletzt bearbeitet 06.03.2025 16:15:44
Quelle contact@wpscan.com
CVE-Watchlists
Login
Unerledigt
Login

Post Timeline <= 2.2.5 - Reflected Cross-Site Scripting

The Post Timeline WordPress plugin before 2.2.6 does not sanitise and escape an invalid nonce before outputting it back in an AJAX response, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

Mögliche Gegenmaßnahme

Post Timeline: Update to version 2.2.6, or a newer patched version

Betroffene Produkte Warnungen 0 Metriken 2 CWE 0 Referenzen 5

Weitere Schwachstelleninformationen

SystemWordPress Plugin

≫

Produkt Post Timeline

Version * - 2.2.5

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Agilelogix ≫ Post Timeline SwPlatformwordpress Version < 2.2.6

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	7.92%	0.917

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	6.1	2.8	2.7	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

https://wpscan.com/vulnerability/1c126869-0afa-456f-94cc-10334964e5f9

Third Party Advisory

https://www.wordfence.com/threat-intel/vulnerabilities/id/f75966a5-e593-4c86-842d-c136ae847eb0

Third Party Advisory

https://nvd.nist.gov/vuln/detail/CVE-2023-4284

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2023-4284

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2023-4284

EUVD