Lucene search

WordfenceCVE-2023-0162

HistoryJan 10, 2023 - 6:15 p.m.

CVE-2023-0162

2023-01-1018:15:10

Wordfence

web.nvd.nist.gov

cpo companion

wordpress

plugin

vulnerability

cve-2023-0162

stored cross-site scripting

input sanitization

output escaping

nvd

CVSS3

5.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

19.3%

JSON

The CPO Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several of its content type settings parameters in versions up to, and including, 1.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Affected configurations

Nvd

Vulners

Node

machothemescpo_companionRange≤1.0.4wordpress

VendorProductVersionCPE
machothemescpo_companion*cpe:2.3:a:machothemes:cpo_companion:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
machothemes	cpo_companion	*	cpe:2.3:a:machothemes:cpo_companion::::::wordpress::*

CNA Affected

[
  {
    "vendor": "wpchill",
    "product": "CPO Companion",
    "versions": [
      {
        "version": "*",
        "status": "affected",
        "lessThanOrEqual": "1.0.4",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

References

plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2844012%40cpo-companion%2Ftrunk&old=2574013%40cpo-companion%2Ftrunk&sfp_email=&sfph_mail=

www.wordfence.com/threat-intel/vulnerabilities/id/9195ac7e-2995-44d0-b5c6-8ffb47395f24

CVSS3

5.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

19.3%

JSON

Related for CVE-2023-0162