CVE-2023-0448

MEDIUMNuclei

WP Helper Lite < 4.3 - Cross-Site Scripting

Title source: github.com
STIX 2.1 vulnerability

Record summary

CVE-2023-0448 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

The WP Helper Lite WordPress plugin, in versions < 4.3, returns all GET parameters unsanitized in the response, resulting in a reflected cross-site scripting vulnerability.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Apr 2, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

WP Helper Lite Wordpress Plugin

CVE ListAll versions prior to version 4.3affected

Nuclei templates

1
ProjectDiscoveryMEDIUMWP Helper Lite < 4.3 - Cross-Site ScriptingCVSS 6.1

The WP Helper Lite WordPress plugin, in versions < 4.3, returns all GET parameters unsanitized in the response, resulting in a reflected cross-site scripting vulnerability.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser, potentially leading to session hijacking, defacement, or theft of sensitive information.

Remediation

Fixed in version 4.3 and above

WeaknessesCWE-79
Authorsritikchaddha
Template tagscvecve2023wordpresswpwp-pluginwpscanxsswp-helper-litematbaovuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:matbao:wp_helper_premium:*:*:*:*:*:wordpress:*:*
Shodan: http.html:/wp-content/plugins/wp-helper-lite
FOFA: body=/wp-content/plugins/wp-helper-lite
https://wpscan.com/vulnerability/1f24db34-f608-4463-b4ee-9bc237774256 https://nvd.nist.gov/vuln/detail/CVE-2023-0448 https://github.com/ARPSyndicate/cvemon https://github.com/JoshuaMart/JoshuaMart

Source: ProjectDiscovery

References

2