CVE-2023-0644

State: PUBLISHED · Published: 2023-05-15 · Updated: 2025-01-14 · Assigner: WPScan

Description

The Push Notifications for WordPress by PushAssist WordPress plugin through 3.0.8 does not sanitise and escape various parameters before outputting them back in pages, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin.

CWE

(none)

Affected

Unknown / Push Notifications for WordPress by PushAssist — v=0 ≤3.0.8 [affected]

CVSS

(none)

References

https://wpscan.com/vulnerability/08f5089c-36f3-4d12-bca5-99cd3ae78f67 exploit, vdb-entry, technical-description

Source

cvelistV5-main/cves/2023/0xxx/CVE-2023-0644.json