CVE-2023-4925

CWE-79 — Cross-site Scripting (XSS)3 documents3 sources

Severity

4.8MEDIUM

EPSS

0.1%

top 76.07%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Unknown Easy Forms FOR Mailchimp Yikesinc Easy Forms FOR Mailchimp

Timeline

PublishedJan 15

Description

The Easy Forms for Mailchimp WordPress plugin through 6.8.10 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:NExploitability: 1.7 | Impact: 2.7

Affected Packages2 packages

▶CVEListV5unknown/easy_forms_for_mailchimp6.8.10

▶NVDyikesinc/easy_forms6.8.10

🔴Vulnerability Details

GHSA

GHSA-x3vr-qx95-wxg3: The Easy Forms for Mailchimp WordPress plugin through 6↗2024-01-15

▶

CVEList

Easy Forms for Mailchimp <= 6.8.10 - Admin+ Stored Cross-Site Scripting↗2024-01-15

▶