WordPress Plugin Vulnerabilities

CopySafe Web Protection < 3.14 - Unauthenticated Reflected XSS

Description

The plugin does not properly sanitize and escape the file name in it's file uploads functionality before reflecting it back on the page, allowing an unauthenticated attacker to inject arbitrary web scripts via the filename of uploaded files.

Affects Plugins

Plugin icon
wp-copysafe-web
Fixed in 3.14

References

CVE
CVE-2023-29098
URL
https://patchstack.com/database/vulnerability/wp-copysafe-web/wordpress-copysafe-web-protection-plugin-3-13-cross-site-scripting-xss-vulnerability

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
7.1 (high)

Miscellaneous

Original Researcher
Elliot
Verified
No
WPVDB ID
6202b933-31a5-4c9b-b108-dae52f70f3b3

Timeline

Publicly Published
2023-04-03 (about 3 years ago)
Added
2023-05-30 (about 2 years ago)
Last Updated
2023-05-30 (about 2 years ago)

Other

Published
Title
Published
2025-04-24
Title
Peekaboo <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2021-09-08
Title
Custom Menu Plugin <= 1.3.3 - Reflected Cross-Site Scripting
Published
2020-09-20
Title
Ninja Forms < 3.4.28 - Stored Cross-Site Scripting
Published
2023-10-18
Title
YouTube Playlist Player < 4.6.8 - Contributor+ Stored XSS
Published
2024-04-26
Title
Cornerstone < 0.8.1 - Reflected Cross-Site Scripting