CVE-2023-4284

MEDIUMNuclei

Post Timeline < 2.2.6 - Reflected XSS

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2023-4284 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

The Post Timeline WordPress plugin before 2.2.6 does not sanitise and escape an invalid nonce before outputting it back in an AJAX response, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Mar 6, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

Post Timeline

Default status: unaffected

CVE ListBefore 2.2.6affected

Nuclei templates

1
ProjectDiscoveryHIGHWordPress Post Timeline Plugin < 2.2.6 - Cross-Site ScriptingCVSS 7.1

The Post Timeline WordPress plugin before version 2.2.6 contains a reflected cross-site scripting vulnerability. The plugin does not properly sanitize and escape an invalid nonce before outputting it back in an AJAX response, which could allow attackers to execute arbitrary JavaScript code in an administrator's browser context.

Impact

Authenticated attackers can inject malicious JavaScript through an invalid nonce parameter in AJAX responses to execute code in administrator browsers and potentially hijack WordPress sites.

Remediation

Update Post Timeline plugin to version 2.2.6 or later that properly sanitizes and escapes the nonce parameter in AJAX responses.

WeaknessesCWE-79
Authorsritikchaddha
Template tagscvecve2023wordpresswpwp-pluginxsspost-timelineauthenticatedvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
CPE: cpe:2.3:a:agilelogix:post_timeline:*:*:*:*:*:wordpress:*:*
Shodan: http.html:"wp-content/plugins/post-timeline/"
FOFA: body="wp-content/plugins/post-timeline/"
https://wpscan.com/vulnerability/1c126869-0afa-456f-94cc-10334964e5f9 https://nvd.nist.gov/vuln/detail/CVE-2023-4284

Source: ProjectDiscovery

References

2