CVE-2023-2362

Multiple Plugins from Wow-Company - Reflected XSS

State: Published
Severity: 6.1 Medium
Published: Jun 12, 2023
Updated: May 5, 2025
Reserved: Apr 28, 2023

Description

The Float menu WordPress plugin before 5.0.2, Bubble Menu WordPress plugin before 3.0.4, Button Generator WordPress plugin before 2.3.5, Calculator Builder WordPress plugin before 1.5.1, Counter Box WordPress plugin before 1.2.2, Floating Button WordPress plugin before 5.3.1, Herd Effects WordPress plugin before 5.2.2, Popup Box WordPress plugin before 2.2.2, Side Menu Lite WordPress plugin before 4.0.2, Sticky Buttons WordPress plugin before 3.1.1, Wow Skype Buttons WordPress plugin before 4.0.2, WP Coder WordPress plugin before 2.5.6 do not escape the page parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

Scores

CVSS	Score	Vector	Source
3.1	6.1 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	CISA-ADP

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
Float menuUnknown	before 5.0.2Affected
Bubble MenuUnknown	before 3.0.4Affected
Button GeneratorUnknown	before 2.3.5Affected
Calculator BuilderUnknown	before 1.5.1Affected
Counter BoxUnknown	before 1.2.2Affected
Floating ButtonUnknown	before 5.3.1Affected
Herd EffectsUnknown	before 5.2.2Affected
Popup BoxUnknown	before 2.2.2Affected
Side Menu LiteUnknown	before 4.0.2Affected
Sticky ButtonsUnknown	before 3.1.1Affected
Wow Skype ButtonsUnknown	before 4.0.2Affected
WP CoderUnknown	before 2.5.6Affected

References

https://wpscan.com/vulnerability/27e70507-fd68-4915-88cf-0b96ed55208eexploitvdb-entrytechnical-description

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.