VulnerabilityModified

CVE-2023-2023

The Custom 404 Pro WordPress plugin before 3.7.3 does not escape some URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting.

MEDIUM 6.1EPSS 1.71%

Does this matter?

Lower severity and a low EPSS score (1.71%). Track it; it rarely justifies an emergency change on its own.

Description

The Custom 404 Pro WordPress plugin before 3.7.3 does not escape some URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting.

CVSS 3.1: 6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS: 1.71% probability · 76th percentile
CISA KEV: Not listed
Weakness: CWE-79
Affected: kunalnagar/custom 404 pro
Source: contact@wpscan.com

References

https://wpscan.com/vulnerability/8859843a-a8c2-4f7a-8372-67049d6ea317Exploit
https://wpscan.com/vulnerability/8859843a-a8c2-4f7a-8372-67049d6ea317Exploit

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.