Description
The Subscribers Text Counter WordPress plugin before 1.7.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack, which also lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping
Published: 2023-08-30
Score: 4.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2023-44023 The Subscribers Text Counter WordPress plugin before 1.7.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack, which also lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping
History

Tue, 01 Oct 2024 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Subscriptions

Kreci Subscribers Text Counter
cve-icon MITRE

Status: PUBLISHED

Assigner: WPScan

Published:

Updated: 2024-10-01T18:32:54.412Z

Reserved: 2023-06-21T17:41:40.393Z

Link: CVE-2023-3356

cve-icon Vulnrichment

Updated: 2024-08-02T06:55:02.689Z

cve-icon NVD

Status : Modified

Published: 2023-08-30T15:15:09.257

Modified: 2024-11-21T08:17:05.440

Link: CVE-2023-3356

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses