CVE-2023-5940 in WP Not Login Hide Plugin

Sumário

de MITRE • 11/12/2023

The WP Not Login Hide (WPNLH) WordPress plugin through 1.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

• Reservar: 02/11/2023
• Divulgação: 11/12/2023
• Moderação: aceite
• Entrada: VDB-245496
• CPE: pronto
• CWE: CWE-79 (confirmado)
• CVSS: 2.4 (VulDB)
• EPSS: 0.00425
• KEV: não
• Atividades: muito baixo
• Sector: Hostingprovider

Fontes

• MITRE: https://www.cve.org/CVERecord?id=CVE-2023-5940
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-5940
• CVE Details: https://www.cvedetails.com/cve/CVE-2023-5940/