WordPress Plugin Vulnerabilities

TreePress – Easy Family Trees & Ancestor Profiles < 3.0.0 - Admin+ Stored Cross-Site Scripting

Description

The plugin does not sanitise and escape some parameters, which could allow users with the Admin role to perform Cross-Site Scripting attacks.

Affects Plugins

Plugin icon
treepress
Fixed in 3.0.0

References

CVE
CVE-2023-23863

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
3.5 (low)

Miscellaneous

Original Researcher
yuyudhn
Verified
No
WPVDB ID
4ca6d706-35b3-4482-bca7-2a0fa788dab2

Timeline

Publicly Published
2023-03-20 (about 3 years ago)
Added
2023-05-09 (about 3 years ago)
Last Updated
2023-05-09 (about 3 years ago)

Other

Published
Title
Published
2025-04-22
Title
List Last Changes < 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2022-05-23
Title
Simple Membership < 4.1.1 - Reflected Cross-Site Scripting
Published
2024-06-06
Title
Link Library < 7.6.4 - Reflected Cross-Site Scripting
Published
2024-03-25
Title
Shipping with Venipak for WooCommerce < 1.19.6 - Reflected Cross-Site Scripting via 'venipak_labels_link'
Published
2025-03-31
Title
Twice Commerce < 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting