CVEvulnerability
CVE-2023-2579
5.4 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2023-07-17
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 5.4 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Description
The InventoryPress WordPress plugin through 1.7 does not sanitise and escape some of its settings, which could allow users with the role of author and above to perform Stored Cross-Site Scripting attacks.
Affected configurations
• inventorypress project inventorypress (<= 1.7)
References
- https://github.com/daniloalbuqrque/poc-cve-xss-inventory-press-plugin Exploit, Third Party Advisory
- https://wpscan.com/vulnerability/3cfcb8cc-9c4f-409c-934f-9f3f043de6fe Exploit, Third Party Advisory
- https://github.com/daniloalbuqrque/poc-cve-xss-inventory-press-plugin Exploit, Third Party Advisory
- https://wpscan.com/vulnerability/3cfcb8cc-9c4f-409c-934f-9f3f043de6fe Exploit, Third Party Advisory