Lucene search

K
cvelistPatchstackCVELIST:CVE-2023-38516
HistorySep 03, 2023 - 11:25 a.m.

CVE-2023-38516 WordPress Audio Player with Playlist Ultimate Plugin <= 1.2.2 is vulnerable to Cross Site Scripting (XSS)

2023-09-0311:25:55
CWE-79
Patchstack
www.cve.org
5
wordpress
audio player
playlist ultimate
cross site scripting
vulnerability
cve

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

EPSS

0.001

Percentile

21.6%

Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in WP OnlineSupport, Essential Plugin Audio Player with Playlist Ultimate plugin <=Β 1.2.2 versions.

CNA Affected

[
  {
    "collectionURL": "https://wordpress.org/plugins",
    "defaultStatus": "unaffected",
    "packageName": "audio-player-with-playlist-ultimate",
    "product": "Audio Player with Playlist Ultimate",
    "vendor": "WP OnlineSupport, Essential Plugin",
    "versions": [
      {
        "changes": [
          {
            "at": "1.3",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "1.2.2",
        "status": "affected",
        "version": "n/a",
        "versionType": "custom"
      }
    ]
  }
]

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

EPSS

0.001

Percentile

21.6%

Related for CVELIST:CVE-2023-38516