CVE-2023-0439

low-risk
Published 2023-07-17

The NEX-Forms WordPress plugin before 8.4.4 does not escape its form name, which could lead to Stored Cross-Site Scripting issues. By default only SuperAdmins (in multisite) / admins (in single site) can create forms, however there is a settings allowing them to give lower roles access to such feature.

Do I need to act?

-
0.12% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
5
CVSS 5.4/10 Medium
NETWORK / LOW complexity

Affected Products (1)

Affected Vendors

Basixonline

References (2)

Third Party Advisory https://wpscan.com/vulnerability/04cea9aa-b21c-49f8-836b-2d312253e09a
Third Party Advisory https://wpscan.com/vulnerability/04cea9aa-b21c-49f8-836b-2d312253e09a
26
/ 100
low-risk
Severity 21/34 · High
Exploitability 0/34 · Minimal
Exposure 5/34 · Minimal