VulnerabilityModified
CVE-2023-4284
The Post Timeline WordPress plugin before 2.2.6 does not sanitise and escape an invalid nonce before outputting it back in an AJAX response, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
MEDIUM 6.1EPSS 0.76%
Does this matter?
Lower severity and a low EPSS score (0.76%). Track it; it rarely justifies an emergency change on its own.
Description
The Post Timeline WordPress plugin before 2.2.6 does not sanitise and escape an invalid nonce before outputting it back in an AJAX response, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- CVSS 3.1
- 6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- EPSS
- 0.76% probability · 53th percentile
- CISA KEV
- Not listed
- Affected
- agilelogix/post timeline
- Source
- contact@wpscan.com
References
- https://wpscan.com/vulnerability/1c126869-0afa-456f-94cc-10334964e5f9Third Party Advisory
- https://wpscan.com/vulnerability/1c126869-0afa-456f-94cc-10334964e5f9Third Party Advisory
- https://wpscan.com/vulnerability/1c126869-0afa-456f-94cc-10334964e5f9Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.