CVE-2023-3136
Last modified
CVE-2023-3136 is a medium-severity vulnerability rated 6.1/10 on the CVSS scale. The MailArchiver plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an email subject in versions up to, and including, 2.10.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.. EPSS estimates a 0.42% chance of exploitation in the next 30 days.
Description
The MailArchiver plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an email subject in versions up to, and including, 2.10.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Perfopsone | Mailarchiver | <= 2.10.1 |
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2023-3136?
How severe is CVE-2023-3136?
How do I fix CVE-2023-3136?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2023
- CVE-2023-31351Improper restriction of operations in the IOMMU could allow …5.3
- CVE-2023-31352A bug in the SEV firmware may allow an attacker with privile…6
- CVE-2023-31355Improper restriction of write operations in SNP firmware cou…6
- CVE-2023-31356Incomplete system memory cleanup in SEV firmware could allow…4.4
- CVE-2023-31358A DLL hijacking vulnerability in the AMD Manageability API c…7.8
- CVE-2023-31359Incorrect default permissions in the AMD Manageability API c…7.8
- CVE-2023-31360Incorrect default permissions in the AMD Integrated Manageme…7.3
- CVE-2023-31361A DLL hijacking vulnerability in AMD Integrated Management T…7.3
- CVE-2023-31364Improper handling of direct memory writes in the input-outpu…8.3
- CVE-2023-31365An integer overflow in the SMU could allow a privileged atta…3.9
- CVE-2023-31366Improper input validation in AMD μProf could allow an attack…5.5
- CVE-2023-3138A vulnerability was found in libX11. The security flaw occur…7.5
Are you affected by CVE-2023-3136?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST