CVE-2023-5620

Published Nov 27, 2023

Last updated a year ago

CVSS medium 5.4

Overview

Description: The Web Push Notifications WordPress plugin before 4.35.0 does not prevent visitors on the site from changing some of the plugin options, some of which may be used to conduct Stored XSS attacks.
Source: contact@wpscan.com
NVD status: Analyzed

Risk scores

CVSS 3.1

Type: Primary
Base score: 5.4
Impact score: 2.7
Exploitability score: 2.3
Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Severity: MEDIUM

Weaknesses

nvd@nist.gov: CWE-79

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:webpushr:web_push_notifications:*:*:*:*:*:wordpress:*:*",
            "vulnerable": true,
            "matchCriteriaId": "893D6956-0070-406E-A957-25CB79FD76A2",
            "versionEndExcluding": "4.35.0"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References