CVSS: 5.3EPSS: 0%CPEs: 17EXPL: 3CVE-2023-5561 – WordPress < 6.3.2 - Unauthenticated Post Author Email Disclosure
https://notcve.org/view.php?id=CVE-2023-5561
WordPress does not properly restrict which user fields are searchable via the REST API, allowing unauthenticated attackers to discern the email addresses of users who have published public posts on an affected website via an Oracle style attack El complemento Popup Builder de WordPress hasta la versión 4.1.15 no sanitiza ni escapa a algunas de sus configuraciones, lo que podría permitir a usuarios con privilegios elevados, como el administrador, realizar ataques de Cross-Site Scripting almacenados incluso cuando la capacidad unfiltered_html no está permitida (por ejemplo, en una configuración multisitio). WordPress Core is vulnerable to Sensitive Information Exposure in versions between 4.7.0 and 6.3.1 via the User REST endpoint. While the search results do not display user email addresses unless the requesting user has the 'list_users' capability, the search is applied to the user_email column. This can allow unauthenticated attackers to brute force or verify the email addresses of users with published posts or pages on the site. • https://github.com/pog007/CVE-2023-5561-PoC https://lists.debian.org/debian-lts-announce/2023/11/msg00014.html https://wpscan.com/blog/email-leak-oracle-vulnerability-addressed-in-wordpress-6-3-2 https://wpscan.com/vulnerability/19380917-4c27-4095-abf1-eba6f913b441 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.5EPSS: 0%CPEs: 6EXPL: 1CVE-2023-38000 – Auth. Stored Cross-Site Scripting (XSS) vulnerability in WordPress core and Gutenberg plugin via Navigation Links Block
https://notcve.org/view.php?id=CVE-2023-38000
Auth. Stored (contributor+) Cross-Site Scripting (XSS) vulnerability in WordPress core 6.3 through 6.3.1, from 6.2 through 6.2.2, from 6.1 through 6.1.3, from 6.0 through 6.0.5, from 5.9 through 5.9.7 and Gutenberg plugin <= 16.8.0 versions. Vulnerabilidad de Coss-Site Scripting (XSS) autenticada (con permisos de colaboradores o superiores) almacenada en WordPress core 6.3 a 6.3.1, de 6.2 a 6.2.2, de 6.1 a 6.1.3, de 6.0 a 6.0.5, de 5.9 a 5.9.7 y versiones del complemento Gutenberg en versiones <= 16.8.0. WordPress Core is vulnerable to Stored Cross-Site Scripting via the arrow navigation block attributes in versions between 5.9 and 6.3.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with contributor-level privileges and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. • https://patchstack.com/articles/wordpress-core-6-3-2-security-update-technical-advisory?_s_id=cve https://patchstack.com/database/vulnerability/gutenberg/wordpress-gutenberg-plugin-16-8-0-contributor-stored-xss-in-navigation-links-block-vulnerability?_s_id=cve https://patchstack.com/database/vulnerability/wordpress/wordpress-core-6-3-2-contributor-stored-xss-in-navigation-links-block-vulnerability?_s_id=cve • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 25EXPL: 1CVE-2023-39999 – WordPress < 6.3.2 is vulnerable to Broken Access Control
https://notcve.org/view.php?id=CVE-2023-39999
Exposure of Sensitive Information to an Unauthorized Actor in WordPress from 6.3 through 6.3.1, from 6.2 through 6.2.2, from 6.1 through 6.13, from 6.0 through 6.0.5, from 5.9 through 5.9.7, from 5.8 through 5.8.7, from 5.7 through 5.7.9, from 5.6 through 5.6.11, from 5.5 through 5.5.12, from 5.4 through 5.4.13, from 5.3 through 5.3.15, from 5.2 through 5.2.18, from 5.1 through 5.1.16, from 5.0 through 5.0.19, from 4.9 through 4.9.23, from 4.8 through 4.8.22, from 4.7 through 4.7.26, from 4.6 through 4.6.26, from 4.5 through 4.5.29, from 4.4 through 4.4.30, from 4.3 through 4.3.31, from 4.2 through 4.2.35, from 4.1 through 4.1.38. Exposición de Información Confidencial a un Actor No Autorizado en WordPress desde 6.3 hasta 6.3.1, desde 6.2 hasta 6.2.2, desde 6.1 hasta 6.13, desde 6.0 hasta 6.0.5, desde 5.9 hasta 5.9.7, desde 5.8 hasta 5.8.7, del 5.7 al 5.7.9, del 5.6 al 5.6.11, del 5.5 al 5.5.12, del 5.4 al 5.4.13, del 5.3 al 5.3.15, del 5.2 al 5.2.18, del 5.1 al 5.1.16, del 5.0 al 5.0.19, del 4.9 al 4.9.23, del 4.8 al 4.8.22, del 4.7 al 4.7.26, del 4.6 al 4.6.26, del 4.5 al 4.5.29, del 4.4 al 4.4.30, del 4.3 al 4.3.31, del 4.2 al 4.2.35, del 4.1 al 4.1.38. WordPress Core is vulnerable to Sensitive Information Exposure in versions up to, and including, 6.3.1 via the comments listing. This allows authenticated users, with contributor-level privileges or above, to view comments on protected posts. • https://lists.debian.org/debian-lts-announce/2023/11/msg00014.html https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2EVFT4DPZRFTXJPEPADM22BZVIUD2P66 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GCCVDPKOK57WCTH2QJ5DJM3B53RJNZKA https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WQBL4ZQCBFNQ76XHM5257CIBFQRGT5QY https://patchstack.com/articles/wordpress-core-6-3-2-security-update-technical-advisory?_s_id=cve https:&# • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •