CVE-2023-4820
Last modified
CVE-2023-4820 is a medium-severity vulnerability rated 5.4/10 on the CVSS scale. The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.0.12 does not sanitize and escape the media url field in posts, which could allow users with privileges as low as contributor to inject arbitrary web scripts that could target a site admin or superadmin.. EPSS estimates a 0.40% chance of exploitation in the next 30 days.
Description
The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.0.12 does not sanitize and escape the media url field in posts, which could allow users with privileges as low as contributor to inject arbitrary web scripts that could target a site admin or superadmin.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Blubrry | Powerpress | < 11.0.12 |
References
- https://wpscan.com/vulnerability/e866a214-a142-43c7-b93d-ff2301a3e432Exploit, Third Party Advisory
- https://wpscan.com/vulnerability/e866a214-a142-43c7-b93d-ff2301a3e432Exploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2023-4820?
How severe is CVE-2023-4820?
How do I fix CVE-2023-4820?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2023
- CVE-2023-48192An issue in TOTOlink A3700R v.9.1.2u.6134_B20201202 allows a…7.8
- CVE-2023-48193Insecure Permissions vulnerability in JumpServer GPLv3 v.3.8…9.8
- CVE-2023-48194Vulnerability in Tenda AC8v4 .V16.03.34.09 due to sscanf and…9.8
- CVE-2023-48197Cross-Site Scripting (XSS) vulnerability in the ‘manageApiKe…5.4
- CVE-2023-48198A Cross-Site Scripting (XSS) vulnerability in the 'product d…5.4
- CVE-2023-48199HTML Injection vulnerability in the 'manageApiKeys' componen…7.8
- CVE-2023-48200Cross Site Scripting vulnerability in Grocy v.4.0.3 allows a…5.4
- CVE-2023-48201Cross Site Scripting (XSS) vulnerability in Sunlight CMS v.8…5.4
- CVE-2023-48202Cross-Site Scripting (XSS) vulnerability in Sunlight CMS 8.0…5.4
- CVE-2023-48204An issue in PublicCMS v.4.0.202302.e allows a remote attacke…6.5
- CVE-2023-48205Jorani Leave Management System 1.0.2 allows a remote attacke…5.3
- CVE-2023-48206A Cross Site Scripting (XSS) vulnerability in GaatiTrack Cou…6.1
Are you affected by CVE-2023-4820?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST