WordPress PowerPack Pro for Elementor Plugin <= 2.9.23 is vulnerable to Cross Site Scripting (XSS)
CVE-2023-49739

7.1HIGH

Key Information:

Vendor
WordPress
Status
Powerpack Pro For Elementor
Vendor
CVE Published:
14 December 2023

Summary

A reflected cross-site scripting vulnerability exists in the PowerPack Pro for Elementor plugin for WordPress, versions 2.9.23 and earlier. This flaw allows attackers to inject malicious scripts into a webpage, potentially compromising user interactions via manipulated URLs. An exploit of this vulnerability could lead users to execute unintended actions or expose sensitive information, as the script executes in the context of the affected site.

Affected Version(s)

PowerPack Pro for Elementor <= 2.9.23

References

https://patchstack.com/database/vulnerability/powerpack-e...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Rafie Muhammad (Patchstack)
.