WordPress Ebook Store Plugin <= 5.785 is vulnerable to Cross Site Scripting (XSS)
CVE-2023-45602

7.1HIGH

Key Information:

Vendor

WordPress
Status
Ebook Store
Vendor
CVE Published:
18 October 2023

What is CVE-2023-45602?

A security flaw has been identified in the Ebook Store plugin developed by Shopfiles Ltd, allowing unauthenticated users to exploit reflected cross-site scripting (XSS) vulnerabilities present in versions 5.785 and lower. This vulnerability can lead to the execution of malicious scripts in the context of a user's session, potentially compromising sensitive information and user interactions. WordPress site administrators using this plugin are advised to apply patches or updates promptly to mitigate the risk posed by this vulnerability.

Affected Version(s)

Ebook Store <= 5.785

References

https://patchstack.com/database/vulnerability/ebook-store...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Le Ngoc Anh (Patchstack Alliance)
.