CVE-2023-0442
Last modified
CVE-2023-0442 is a medium-severity vulnerability rated 6.1/10 on the CVSS scale. The Loan Comparison WordPress plugin before 1.5.3 does not validate and escape some of its query parameters before outputting them back in a page/post via an embedded shortcode, which could allow an attacker to inject javascript into into the site via a crafted URL.. EPSS estimates a 0.49% chance of exploitation in the next 30 days.
Description
The Loan Comparison WordPress plugin before 1.5.3 does not validate and escape some of its query parameters before outputting them back in a page/post via an embedded shortcode, which could allow an attacker to inject javascript into into the site via a crafted URL.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Loan Comparison Project | Loan Comparison | < 1.5.3 |
References
- https://wpscan.com/vulnerability/34d95d88-4114-4597-b4db-e9f5ef80d322Exploit, Third Party Advisory
- https://wpscan.com/vulnerability/34d95d88-4114-4597-b4db-e9f5ef80d322Exploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2023-0442?
How severe is CVE-2023-0442?
How do I fix CVE-2023-0442?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2023
- CVE-2023-0436The affected versions of MongoDB Atlas Kubernetes Operator m…7.5
- CVE-2023-0437When calling bson_utf8_validate on some inputs a loop with a…7.5
- CVE-2023-0438Cross-Site Request Forgery (CSRF) in GitHub repository modob…6.5
- CVE-2023-0439The NEX-Forms WordPress plugin before 8.4.4 does not escape …5.4
- CVE-2023-0440Observable Discrepancy in GitHub repository healthchecks/hea…5.3
- CVE-2023-0441The Gallery Blocks with Lightbox WordPress plugin before 3.0…8.1
- CVE-2023-0443The AnyWhere Elementor WordPress plugin before 1.2.8 disclos…5.3
- CVE-2023-0444A privilege escalation vulnerability exists in Delta Electro…8.8
- CVE-2023-0446The My YouTube Channel plugin for WordPress is vulnerable to…5.5
- CVE-2023-0447The My YouTube Channel plugin for WordPress is vulnerable to…4.3
- CVE-2023-0448The WP Helper Lite WordPress plugin, in versions < 4.3, retu…6.1
- CVE-2023-0449Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
Are you affected by CVE-2023-0442?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST