CVE-2023-4148
Ditty < 3.1.25 - Reflected XSS
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
1Exploited in Wild
-Decision
Descriptions
The Ditty WordPress plugin before 3.1.25 does not sanitise and escape some parameters and generated URLs before outputting them back in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
El complemento Ditty WordPress anterior a la versión 3.1.25 no sanitiza ni escapa algunos parámetros y URL generadas antes de devolverlos en atributos, lo que genera un Cross-Site Scripting reflejado que podrían usarse contra usuarios con privilegios elevados, como el administrador.
The Ditty plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via unescaped URLs in versions up to, and including, 3.1.24 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2023-08-04 CVE Reserved
- 2023-08-29 CVE Published
- 2024-08-02 CVE Updated
- 2024-08-02 First Exploit
- 2024-10-14 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CAPEC
References (1)
URL | Tag | Source |
---|
URL | Date | SRC |
---|---|---|
https://wpscan.com/vulnerability/aa39de78-55b3-4237-84db-6fdf6820c58d | 2024-08-02 |
URL | Date | SRC |
---|
URL | Date | SRC |
---|
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Metaphorcreations Search vendor "Metaphorcreations" | Ditty Search vendor "Metaphorcreations" for product "Ditty" | < 3.1.25 Search vendor "Metaphorcreations" for product "Ditty" and version " < 3.1.25" | wordpress |
Affected
|