CVE-2023-0154

CWE-79 — Cross-site Scripting (XSS)3 documents3 sources

Severity

5.4MEDIUM

EPSS

0.3%

top 51.46%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Unknown Gamipress Gamipress Gamipress

Timeline

PublishedFeb 6

Description

The GamiPress WordPress plugin before 1.0.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NExploitability: 2.3 | Impact: 2.7

Affected Packages2 packages

▶CVEListV5unknown/gamipress< 1.0.9

▶NVDgamipress/gamipress< 1.0.9

🔴Vulnerability Details

GHSA

GHSA-999m-wm5p-rpj8: The GamiPress WordPress plugin before 1↗2023-02-06

▶

CVEList

GamiPress – Vimeo integration < 1.0.9 - Contributor+ Stored XSS↗2023-02-06

▶