CVE-2023-0421

Cloud Manager <= 1.0 - Reflected XSS

Medium · published May 8, 2023

CVSS v3.1
6.1
EPSS
1%
Percentile
42.7
In the wild
Unconfirmed
What it is

The Cloud Manager WordPress plugin through 1.0 does not sanitise and escape the query param ricerca before outputting it in an admin panel, allowing unauthenticated attackers to trick a logged in admin to trigger a XSS payload by clicking a link.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00510 · 42.7th percentile
Published
2023-05-08T13:58Z
EPSS history
Timeline
  • 08 MAY 13:58Z
    Cloud Manager <= 1.0 - Reflected XSS
    cvelistv5