CVE-2023-2178

MEDIUMNuclei

Aajoda Testimonials < 2.2.2 - Admin+ Stored XSS

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2023-2178 has a selected CVSS score of 4.8 (medium); EIP currently links 1 Nuclei template.

Description

The Aajoda Testimonials WordPress plugin before 2.2.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Nov 27, 2024 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

Aajoda Testimonials

Default status: unaffected

CVE ListBefore 2.2.2affected

Nuclei templates

1
ProjectDiscoveryMEDIUMAajoda Testimonials < 2.2.2 - Cross-Site ScriptingCVSS 4.8

The plugin does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

Impact

Successful exploitation of this vulnerability could allow an attacker to inject malicious scripts into web pages viewed by users, leading to potential data theft, session hijacking, or defacement of the affected website.

Remediation

Update Aajoda Testimonials plugin to version 2.2.2 or later to mitigate the vulnerability.

WeaknessesCWE-79
AuthorsFarish
Template tagscve2023cvewpscanwordpresswpwp-pluginxssauthenticatedaajodavuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:aajoda:aajoda_testimonials:*:*:*:*:*:wordpress:*:*
https://wpscan.com/vulnerability/e84b71f9-4208-4efb-90e8-1c778e7d2ebb https://downloads.wordpress.org/plugin/aajoda-testimonials.2.1.0.zip https://nvd.nist.gov/vuln/detail/CVE-2023-2178

Source: ProjectDiscovery

References

2