CVE-2023-2579

moderate-risk
Published 2023-07-17

The InventoryPress WordPress plugin through 1.7 does not sanitise and escape some of its settings, which could allow users with the role of author and above to perform Stored Cross-Site Scripting attacks.

Do I need to act?

!
16.5% chance of exploitation in next 30 days
EPSS score — higher than 83% of all CVEs
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
5
CVSS 5.4/10 Medium
NETWORK / LOW complexity

Affected Products (1)

Affected Vendors

Inventorypress Project

References (4)

Exploit https://github.com/daniloalbuqrque/poc-cve-xss-inventory-press-plugin
Exploit https://wpscan.com/vulnerability/3cfcb8cc-9c4f-409c-934f-9f3f043de6fe
Exploit https://github.com/daniloalbuqrque/poc-cve-xss-inventory-press-plugin
Exploit https://wpscan.com/vulnerability/3cfcb8cc-9c4f-409c-934f-9f3f043de6fe
39
/ 100
moderate-risk
Severity 21/34 · High
Exploitability 13/34 · Low
Exposure 5/34 · Minimal