CVE-2023-5560

WP-UserOnline < 2.88.3 - Unauthenticated Stored XSS

published November 27, 2023

CVSS
—
EPSS
1%
Percentile
42.6
In the wild
Unconfirmed
What it is

The WP-UserOnline WordPress plugin before 2.88.3 does not sanitise and escape the X-Forwarded-For header before outputting its content on the page, which allows unauthenticated users to perform Cross-Site Scripting attacks.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00510 · 42.6th percentile
Published
2023-11-27T16:22Z
EPSS history
Timeline
  • 27 NOV 16:22Z
    WP-UserOnline < 2.88.3 - Unauthenticated Stored XSS
    cvelistv5