Vulnerability · Published Oct 31, 2023 · Assigned by WPScan
CVE-2023-4823WP Meta and Date Remover < 2.2.0 - Subscriber+ Stored XSS
Medium 5.4
In plain English
A medium-severity security flaw in WP Meta and Date Remover from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 39% of all known vulnerabilities).
Severity (CVSS 3.1)5.4Medium
Exploit odds (30 days)0.4%top 61.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
The WP Meta and Date Remover WordPress plugin before 2.2.0 provides an AJAX endpoint for configuring the plugin settings. This endpoint has no capability checks and does not sanitize the user input, which is then later output unescaped. Allowing any authenticated users, such as subscriber change them and perform Stored Cross-Site Scripting.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | WP Meta and Date Remover | 0 – before 2.2.0 |
References
- https://wpscan.com/vulnerability/84f53e27-d8d2-4fa3-91f9-447037508d30 exploit, vdb-entry, technical-description