CVE-2023-4925 Easy Forms for Mailchimp <= 6.8.10 - Admin+ Stored Cross-Site Scripting

2024-01-1515:10:43

WPScan

www.cve.org

cve-2023-4925

easy forms for mailchimp

wordpress plugin

cross-site scripting

admin privileges

unfiltered_html disallowed

0.0004 Low

EPSS

Percentile

14.2%

JSON

The Easy Forms for Mailchimp WordPress plugin through 6.8.10 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "Easy Forms for Mailchimp",
    "versions": [
      {
        "status": "affected",
        "versionType": "semver",
        "version": "0",
        "lessThanOrEqual": "6.8.10"
      }
    ],
    "defaultStatus": "affected",
    "collectionURL": "https://wordpress.org/plugins"
  }
]

References

wpscan.com/vulnerability/0b094cba-9288-4c9c-87a9-bdce286fe8b6

0.0004 Low

EPSS

Percentile

14.2%

JSON

Related for CVELIST:CVE-2023-4925