CVE-2023-0602

Published Jul 31, 2023

Last updated a year ago

CVSS medium 6.1

Overview

Description: The Twittee Text Tweet WordPress plugin through 1.0.8 does not properly escape POST values which are printed back to the user inside one of the plugin's administrative page, which allows reflected XSS attacks targeting administrators to happen.
Source: contact@wpscan.com
NVD status: Modified

Risk scores

CVSS 3.1

Type: Primary
Base score: 6.1
Impact score: 2.7
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Severity: MEDIUM

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:johnniejodelljr:twittee_text_tweet:*:*:*:*:*:wordpress:*:*",
            "vulnerable": true,
            "matchCriteriaId": "942F715B-4924-4AEE-897C-2D0BBD509EC3",
            "versionEndIncluding": "1.0.8"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References