CVE-2023-5560

The WP-UserOnline WordPress plugin before 2.88.3 does not sanitise and escape the X-Forwarded-For header before outputting its content on the page, which allows unauthenticated users to perform Cross-Site Scripting attacks.

CVSS v3.1

6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.51% chance of exploitation in the next 30 days, 41th percentile

Published

2023-11-27

Updated

2024-11-21

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/55d23184-fc5a-4090-b079-142407b59b05

References

• CVE Record
• NVD entry

Related

• CVE-2023-5559
• CVE-2023-5561
• CVE-2023-5558
• CVE-2023-5564
• CVE-2023-5556
• CVE-2023-5571