WordPress Plugin Vulnerabilities

WP Helper Lite < 4.3 - Reflected Cross-Site Scripting

Description

The plugin does not sanitise and escape all GET parameters before outputting them back in an AJAX response, leading to a Reflected Cross-Site Scripting

Proof of Concept

Affects Plugins

Plugin icon
wp-helper-lite
Fixed in 4.3

References

CVE
CVE-2023-0448
URL
https://www.tenable.com/security/research/tra-2023-3

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
7.5 (high)

Miscellaneous

Original Researcher
Joshua Martinelle (Tenable)
Verified
Yes
WPVDB ID
1f24db34-f608-4463-b4ee-9bc237774256

Timeline

Publicly Published
2023-01-23 (about 2 years ago)
Added
2023-01-24 (about 2 years ago)
Last Updated
2023-01-24 (about 2 years ago)

Other

Published
Title
Published
2025-01-21
Title
Stray Random Quotes <= 1.9.9 - Reflected XSS
Published
2023-05-30
Title
Login Configurator <= 2.1 - Reflected XSS
Published
2025-12-15
Title
Multi-Step Checkout for WooCommerce < 2.34 - Authenticated (Administrator+) Stored Cross-Site Scripting
Published
2024-10-30
Title
Pricer Ninja <= 2.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2024-04-15
Title
MJ Update History <= 1.0.4 - Reflected Cross-Site Scripting