Lucene search

WordfenceCVE-2023-6632

HistoryJan 11, 2024 - 9:15 a.m.

CVE-2023-6632

2024-01-1109:15:50

CWE-79

Wordfence

web.nvd.nist.gov

happy addons

elementor

wordpress

plugin

vulnerability

xss

dom

nvd

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

AI Score

6.2

Confidence

High

EPSS

0.001

Percentile

28.6%

JSON

The Happy Addons for Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via DOM in all versions up to and including 3.9.1.1 (versions up to 2.9.1.1 in Happy Addons for Elementor Pro) due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Affected configurations

Nvd

Vulners

Node

wedevshappy_addons_for_elementorRange<3.10.0wordpress

Node

wedevshappy_addons_for_elementorRange<2.10.0prowordpress

VendorProductVersionCPE
wedevshappy_addons_for_elementor*cpe:2.3:a:wedevs:happy_addons_for_elementor:*:*:*:*:*:wordpress:*:*
wedevshappy_addons_for_elementor*cpe:2.3:a:wedevs:happy_addons_for_elementor:*:*:*:*:pro:wordpress:*:*

Vendor	Product	Version	CPE
wedevs	happy_addons_for_elementor	*	cpe:2.3:a:wedevs:happy_addons_for_elementor::::::wordpress::*
wedevs	happy_addons_for_elementor	*	cpe:2.3:a:wedevs:happy_addons_for_elementor:::::pro:wordpress::

CNA Affected

[
  {
    "vendor": "weDevs",
    "product": "Happy Addons for Elementor Pro",
    "versions": [
      {
        "version": "*",
        "status": "affected",
        "lessThanOrEqual": "2.9.1.1",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  },
  {
    "vendor": "thehappymonster",
    "product": "Happy Addons for Elementor",
    "versions": [
      {
        "version": "*",
        "status": "affected",
        "lessThanOrEqual": "3.9.1.1",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

References

plugins.trac.wordpress.org/browser/happy-elementor-addons/trunk/extensions/scroll-to-top.php#L142

plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3011757%40happy-elementor-addons%2Ftrunk&old=2987938%40happy-elementor-addons%2Ftrunk&sfp_email=&sfph_mail=

www.wordfence.com/threat-intel/vulnerabilities/id/06ef69f0-34d3-4389-8a81-a4d9922f1468?source=cve

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

AI Score

6.2

Confidence

High

EPSS

0.001

Percentile

28.6%

JSON

Related for CVE-2023-6632