CVE-2023-0058

CWE-79 — Cross-site Scripting (XSS)CWE-352 — Cross-Site Request Forgery (CSRF)3 documents3 sources
Severity
6.1MEDIUM
EPSS
0.1%
top 77.17%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Unknown Tiempo.comTiempo Tiempo
Timeline
PublishedAug 16

Description

The Tiempo.com WordPress plugin through 0.1.2 does not have CSRF check when creating and editing its shortcode, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages2 packages

▶NVDtiempo/tiempo0.1.2
▶CVEListV5unknown/tiempo.com0.1.2

🔴Vulnerability Details

2
CVEList
Tiempo.com <= 0.1.2 - Stored XSS via CSRF↗2023-08-16
▶
GHSA
GHSA-m256-5rj4-75c4: The Tiempo↗2023-08-16
▶
CVE-2023-0058 (MEDIUM CVSS 6.1) | The Tiempo.com WordPress plugin thr | cvebase.io