Vulnerability in Custom Post Type And Taxonomy Gui Manager Project
CVE-2023-0420
The Custom Post Type and Taxonomy GUI Manager WordPress plugin through 1.1 does not have CSRF, and is lacking sanitising as well as escaping in some parameters, allowing attackers to make a logged in admin put Stored Cross-Site Scripting payloads via CSRF
EPSS: 0.002 (13.9th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 4.8 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N.
Affected products
- Custom_post_type_and_taxonomy_gui_manager_project Custom_post_type_and_taxonomy_gui_manager
- Unknown Custom Post Type And Taxonomy Gui Manager — versions 0
Public proof-of-concept exploits
References
- contact@wpscan.com (Exploit, technical-description, Third Party Advisory, exploit, vdb-entry)
Frequently asked questions
- What is CVE-2023-0420?
- CVE-2023-0420 is a medium-severity vulnerability in Custom Post Type And Taxonomy Gui Manager Project, classified under CWE-79 CROSS-SITE SCRIPTING (XSS). CVSS score: 4.8/10. Published 2023-04-24.
- How severe is CVE-2023-0420?
- Medium severity. CVSS v3 base score is 4.8 out of 10.
- Is CVE-2023-0420 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.