CVE-2023-0378

Greenshift < 5.0 - Contributor+ Stored XSS

Medium · published February 21, 2023

CVSS v3.1
6.8
EPSS
1%
Percentile
49.4
In the wild
Unconfirmed
What it is

The Greenshift WordPress plugin before 5.0 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.

The record
Technical detail
CVSS v3.1
6.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00627 · 49.4th percentile
Published
2023-02-21T08:50Z
EPSS history
Timeline
  • 21 FEB 08:50Z
    Greenshift < 5.0 - Contributor+ Stored XSS
    cvelistv5