Lucene search

PatchstackCVE-2023-23699

HistoryMay 29, 2023 - 3:15 p.m.

CVE-2023-23699

2023-05-2915:15:09

CWE-79

Patchstack

web.nvd.nist.gov

cve-2023-23699

authorization

contributor

stored xss

cross-site scripting

chris reynolds

progress bar

plugin

security vulnerability

nvd

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

AI Score

5.5

Confidence

High

EPSS

0.001

Percentile

17.5%

JSON

Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Chris Reynolds Progress Bar plugin <= 2.2.1 versions.

Affected configurations

Nvd

Vulners

Node

progress_bar_projectprogress_barRange≤2.2.1wordpress

VendorProductVersionCPE
progress_bar_projectprogress_bar*cpe:2.3:a:progress_bar_project:progress_bar:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
progress_bar_project	progress_bar	*	cpe:2.3:a:progress_bar_project:progress_bar::::::wordpress::*

CNA Affected

[
  {
    "collectionURL": "https://wordpress.org/plugins",
    "defaultStatus": "unaffected",
    "packageName": "progress-bar",
    "product": "Progress Bar",
    "vendor": "Chris Reynolds",
    "versions": [
      {
        "changes": [
          {
            "at": "2.2.2",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "2.2.1",
        "status": "affected",
        "version": "n/a",
        "versionType": "custom"
      }
    ]
  }
]

References

patchstack.com/database/vulnerability/progress-bar/wordpress-progress-bar-plugin-2-1-6-cross-site-scripting-xss-vulnerability?_s_id=cve