CVE-2023-0514

MEDIUMNuclei

Membership Database <= 1.0 - Reflected XSS

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2023-0514 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

The Membership Database WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Feb 4, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

Membership Database

Default status: affected

CVE ListThrough 1.0affected

Nuclei templates

1
ProjectDiscoveryMEDIUMMembership Database <= 1.0 - Cross-Site ScriptingCVSS 6.1

Membership Database before 1.0 is susceptible to cross-site scripting via the tab parameter due to insufficient input sanitization and output escaping. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Impact

Successful exploitation of this vulnerability could allow an attacker to inject malicious scripts into web pages viewed by users, leading to potential data theft, session hijacking, or defacement of the affected website.

Remediation

Upgrade to a patched version of the Membership Database software or apply the necessary security patches provided by the vendor.

WeaknessesCWE-79
Authorsr3Y3r53
Template tagscve2023cvewpscanmembership-databasewpwp-pluginwordpressauthenticatedxssmembership_database_projectvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:membership_database_project:membership_database:*:*:*:*:*:wordpress:*:*
https://wpscan.com/vulnerability/c6cc400a-9bfb-417d-9206-5582a49d0f05 https://wordpress.org/plugins/member-database/ https://nvd.nist.gov/vuln/detail/CVE-2023-0514

Source: ProjectDiscovery

References

2