CVE-2023-0603

Sloth Logo Customizer <= 2.0.2 - Stored XSS via CSRF

High · published May 8, 2023

CVSS v3.1

8.8

EPSS

14%

Percentile

96.5

In the wild

Unconfirmed

What it is

The Sloth Logo Customizer WordPress plugin through 2.0.2 does not have CSRF check when updating its settings, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack

The record

Technical detail

CVSS v3.1: 8.8 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0: Not supplied
EPSS: 0.13871 · 96.5th percentile
Published: 2023-05-08T13:58Z

EPSS history

Timeline

08 MAY 13:58Z
Sloth Logo Customizer <= 2.0.2 - Stored XSS via CSRF
cvelistv5