CVE-2023-0644
PushAssist <= 3.0.8 - Reflected Cross-Site Scripting
- State
- Published
- Severity
- 6.1 Medium
- Published
- May 15, 2023
- Updated
- Jan 14, 2025
- Reserved
- Feb 2, 2023
Description
The Push Notifications for WordPress by PushAssist WordPress plugin through 3.0.8 does not sanitise and escape various parameters before outputting them back in pages, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 6.1 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N | CISA-ADP |
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
Push Notifications for WordPress by PushAssistUnknown |
|
References
- https://wpscan.com/vulnerability/08f5089c-36f3-4d12-bca5-99cd3ae78f67exploitvdb-entrytechnical-description
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.