CVEvulnerability
CVE-2023-6503
5.4 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2024-01-29
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 5.4 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
- CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
- 5.4 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
- Weaknesses
- CWE-352
Description
The WP Plugin Lister WordPress plugin through 2.1.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
Affected configurations
• paulgriffinpetty wp plugin lister (<= 2.1.0)
Related
Weakness · CWE (1)
- CWE-352 Cross-Site Request Forgery weakness
References
- https://magos-securitas.com/txt/CVE-2023-6503.txt Exploit
- https://wpscan.com/vulnerability/0d95de23-e8f6-4342-b19c-57cd22b2fee2/ Exploit, Third Party Advisory
- https://magos-securitas.com/txt/CVE-2023-6503.txt Exploit
- https://wpscan.com/vulnerability/0d95de23-e8f6-4342-b19c-57cd22b2fee2/ Exploit, Third Party Advisory