Lucene search

[email protected]NVD:CVE-2023-23891

HistoryApr 06, 2023 - 2:15 p.m.

CVE-2023-23891

2023-04-0614:15:07

CWE-79

[email protected]

web.nvd.nist.gov

cve-2023-23891

authenticated

stored

cross-site scripting

oceanwp ocean extra plugin

oceanwp theme

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

21.0%

JSON

Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in OceanWP Ocean Extra plugin <= 2.1.1 versions. Needs the OceanWP theme installed and activated.

Affected configurations

Nvd

Node

oceanwpocean_extraRange<2.1.2wordpress

VendorProductVersionCPE
oceanwpocean_extra*cpe:2.3:a:oceanwp:ocean_extra:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
oceanwp	ocean_extra	*	cpe:2.3:a:oceanwp:ocean_extra::::::wordpress::*

References

patchstack.com/database/vulnerability/ocean-extra/wordpress-ocean-extra-plugin-2-1-1-cross-site-scripting-xss-vulnerability?_s_id=cve