WordPress Plugin Vulnerabilities

Tags Cloud Manager <= 1.0.0 - Reflected XSS

Description

The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against ??? [high privilege users such as admin|only unauthenticated users]

Affects Plugins

Plugin icon
tags-cloud-manager
No known fix

References

CVE
CVE-2023-28166

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
7.1 (high)

Miscellaneous

Original Researcher
Nithissh S
Verified
No
WPVDB ID
e578f8f7-133c-40c9-9128-8b423c9b66cf

Timeline

Publicly Published
2023-03-14 (about 3 years ago)
Added
2023-06-22 (about 2 years ago)
Last Updated
2023-06-22 (about 2 years ago)

Other

Published
Title
Published
2014-08-01
Title
Widget Control Powered By Everyblock 1.0.1 - wp-admin/admin.php idDropdown Parameter XSS Weakness
Published
2024-11-28
Title
소셜 공유 버튼 By 코스모스팜 <= 1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2025-09-26
Title
Ditty < 3.1.59 - Contributor+ Stored XSS
Published
2025-01-16
Title
Marmoset Viewer <= 1.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2026-01-23
Title
LeadBI Plugin for WordPress <= 1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'form_id' Shortcode Attribute