CVE-2023-1373

CWE-79 — Cross-site Scripting (XSS)CWE-476 — NULL Pointer Dereference4 documents4 sources
Severity
6.1MEDIUM
EPSS
0.1%
top 64.74%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Unknown W4 Post ListW4 Post List Project W4 Post List
Timeline
PublishedApr 17
Latest updateSep 15

Description

The W4 Post List WordPress plugin before 2.4.6 does not escape some URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages2 packages

▶CVEListV5unknown/w4_post_list< 2.4.6

🔴Vulnerability Details

2
CVEList
W4 Post List < 2.4.6 - Reflected XSS↗2023-04-17
▶
GHSA
GHSA-hgqw-hh57-7q9g: The W4 Post List WordPress plugin before 2↗2023-04-17
▶

📋Vendor Advisories

1
Red Hat
kernel: firmware: dmi-sysfs: Fix null-ptr-deref in dmi_sysfs_register_handle↗2025-09-15
▶
CVE-2023-1373 (MEDIUM CVSS 6.1) | The W4 Post List WordPress plugin b | cvebase.io