CVE-2023-4823

WP Meta and Date Remover < 2.2.0 - Subscriber+ Stored XSS

Medium · published October 31, 2023

CVSS v3.1
5.4
EPSS
0%
Percentile
30.5
In the wild
Unconfirmed
What it is

The WP Meta and Date Remover WordPress plugin before 2.2.0 provides an AJAX endpoint for configuring the plugin settings. This endpoint has no capability checks and does not sanitize the user input, which is then later output unescaped. Allowing any authenticated users, such as subscriber change them and perform Stored Cross-Site Scripting.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00377 · 30.5th percentile
Published
2023-10-31T13:54Z
EPSS history
Timeline
  • 31 OCT 13:54Z
    WP Meta and Date Remover < 2.2.0 - Subscriber+ Stored XSS
    cvelistv5