WordPress Plugin Vulnerabilities

CMS Tree Page View < 1.6.8 - Reflected XSS

Description

The plugin does not sanitise and escape some parameters before outputting them back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

Affects Plugins

Plugin icon
cms-tree-page-view
Fixed in 1.6.8

References

CVE
CVE-2023-30868

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
7.1 (high)

Miscellaneous

Original Researcher
LEE SE HYOUNG
Verified
No
WPVDB ID
407c62af-8e2d-441d-8332-0afad5d07014

Timeline

Publicly Published
2023-04-20 (about 2 years ago)
Added
2023-05-18 (about 2 years ago)
Last Updated
2023-05-18 (about 2 years ago)

Other

Published
Title
Published
2022-01-14
Title
Random Banner < 4.1.6 - Admin+ Stored Cross-Site Scripting
Published
2024-06-04
Title
Brizy – Page Builder < 2.4.44 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Attributes
Published
2021-09-06
Title
User Registration < 2.0.2 - Low Privilege Stored Cross-Site Scripting
Published
2024-11-15
Title
SVG Case Study <= 1.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
Published
2024-07-10
Title
FULL < 3.1.13 - Unauthenticated Stored Cross-Site Scripting via License Plan Parameter