WordPress Plugin Vulnerabilities

WOLF < 1.0.7 - Subscriber+ Stored XSS

Description

The plugin does not sanitise and escape parameters of the wpbe_update_page_field function, allowing any authenticated users, such as subscriber to perform Cross-Site Scripting attacks. The function is also missing a CSRF check, making the issue also exploitable via CSRF

Affects Plugins

Plugin icon
bulk-editor
Fixed in 1.0.7

References

CVE
CVE-2023-31218

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
8.0 (high)

Miscellaneous

Original Researcher
Junsu Yeo
Verified
No
WPVDB ID
e84e4d33-7042-471c-8185-d31b695bb3eb

Timeline

Publicly Published
2023-05-03 (about 3 years ago)
Added
2023-08-21 (about 2 years ago)
Last Updated
2023-08-21 (about 2 years ago)

Other

Published
Title
Published
2023-01-20
Title
ProfilePress < 4.5.4 - Admin+ Stored XSS
Published
2023-11-10
Title
Sponsors <= 3.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Published
2025-01-02
Title
Download HTML TinyMCE Button <= 1.2 - Reflected XSS
Published
2015-08-05
Title
WordPress <= 4.2.3 - Nav Menu Title Cross-Site Scripting (XSS)
Published
2025-01-14
Title
wp-pano <= 1.17 - Authenticated (Contributor+) Stored Cross-Site Scripting