CVE-2023-1804

Product Catalog Feed by PixelYourSite < 2.1.1 - Reflected XSS

Medium · published May 2, 2023

CVSS v3.1
6.1
EPSS
1%
Percentile
43.2
In the wild
Unconfirmed
What it is

The Product Catalog Feed by PixelYourSite WordPress plugin before 2.1.1 does not sanitise and escape the edit parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as administrators.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00519 · 43.2th percentile
Published
2023-05-02T07:04Z
EPSS history
Timeline
  • 02 MAY 07:04Z
    Product Catalog Feed by PixelYourSite < 2.1.1 - Reflected XSS
    cvelistv5