CVE-2023-1080

MEDIUMNuclei

GN Publisher <= 1.5.5 - Reflected Cross-Site Scripting

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2023-1080 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

The GN Publisher plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘tab’ parameter in versions up to, and including, 1.5.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Jan 13, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

GN Publisher: Google News Compatible RSS Feeds

Browse gnpublisher / GN Publisher: Google News Compatible RSS Feeds

Default status: unaffected

CVE ListThrough 1.5.5affected

Nuclei templates

1
ProjectDiscoveryMEDIUMWordPress GN Publisher <1.5.6 - Cross-Site ScriptingCVSS 6.1

WordPress GN Publisher plugin before 1.5.6 is susceptible to cross-site scripting via the tab parameter due to insufficient input sanitization and output escaping. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Impact

Successful exploitation of this vulnerability could lead to the execution of arbitrary script code in the context of the affected website, potentially allowing an attacker to steal sensitive information or perform unauthorized actions.

Remediation

Fixed in version 1.5.6.

WeaknessesCWE-79
Authorsr3Y3r53
Template tagscve2023cvewp-pluginwordpressgn-publisherauthenticatedwpxsswpscangnpublishervuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:gnpublisher:gn_publisher:*:*:*:*:*:wordpress:*:*
https://wpscan.com/vulnerability/fcbcfb56-640d-4071-bc12-acac1b1e7a74 https://wordpress.org/plugins/gn-publisher/ https://www.wordfence.com/threat-intel/vulnerabilities/id/8a4ee97c-63cd-4a5e-a112-6d4c4c627a57 https://nvd.nist.gov/vuln/detail/CVE-2023-1080 https://plugins.trac.wordpress.org/browser/gn-publisher/trunk/templates/settings.php#L70

Source: ProjectDiscovery

References

5