CVE-2023-5620

Webpushr < 4.35.0 - Unauthenticated Stored XSS

The Web Push Notifications WordPress plugin before 4.35.0 does not prevent visitors on the site from changing some of the plugin options, some of which may be used to conduct Stored XSS attacks.

Affected

Web Push Notifications

CVSS v3.1 NVD

5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS

0.43% chance of exploitation in the next 30 days, 36th percentile

Published

2023-11-27

Updated

2024-08-02

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/a03330c2-3ae0-404d-a114-33b18cc47666

References

• CVE Record
• NVD entry