Bonus for Woo < 5.8.3 - Reflected Cross-Site Scripting
CVE-2023-5140

6.1MEDIUM

Key Information:

Vendor

Wordpress
Status
Bonus for Woo
Vendor
CVE Published:
20 November 2023

What is CVE-2023-5140?

The Bonus for Woo WordPress plugin before 5.8.3 does not sanitise and escape some parameters before outputting them back in pages, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin.

Affected Version(s)

Bonus for Woo 0 < 5.8.3

References

https://wpscan.com/vulnerability/ee1824e8-09a6-4763-b65e-...
exploitvdb-entrytechnical-description

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Enrico Marcolini
Claudio Marchesini
WPScan
.