CVE-2023-23891

CWE-79 — Cross-site Scripting (XSS)3 documents3 sources

Severity

5.4MEDIUM

EPSS

0.2%

top 60.22%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Oceanwp Ocean Extra

Timeline

PublishedApr 6

Description

Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in OceanWP Ocean Extra plugin <= 2.1.1 versions. Needs the OceanWP theme installed and activated.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:LExploitability: 1.3 | Impact: 3.7

Affected Packages2 packages

▶NVDoceanwp/ocean_extra< 2.1.2

▶CVEListV5oceanwp/ocean_extran/a — 2.1.1

🔴Vulnerability Details

GHSA

GHSA-5phh-m88v-jf8m: Auth↗2023-04-06

▶

CVEList

WordPress Ocean Extra Plugin <= 2.1.1 is vulnerable to Cross Site Scripting (XSS)↗2023-04-06

▶