CVE-2023-0543: Arigato Autoresponder and Newsletter < 2.1.7.2 - Admin+ Stored XSS
First published: Mon Feb 27 2023(Updated: )
The Arigato Autoresponder and Newsletter WordPress plugin before 2.1.7.2 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Credit: contact@wpscan.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Kibokolabs Arigato Autoresponder And Newsletter | <2.1.7.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the vulnerability ID for the Arigato Autoresponder and Newsletter WordPress plugin?
The vulnerability ID for the Arigato Autoresponder and Newsletter WordPress plugin is CVE-2023-0543.
What is the severity of CVE-2023-0543?
The severity of CVE-2023-0543 is medium with a CVSS score of 4.8.
What is the affected software by CVE-2023-0543?
The Arigato Autoresponder and Newsletter WordPress plugin versions up to 2.1.7.2 are affected by CVE-2023-0543.
What is the impact of CVE-2023-0543?
CVE-2023-0543 allows high-privilege users, such as admin, to perform Stored Cross-Site Scripting (XSS) attacks, even when the unfiltered_html capability is disallowed.
How can I fix CVE-2023-0543 in the Arigato Autoresponder and Newsletter WordPress plugin?
To fix CVE-2023-0543, update to version 2.1.7.2 or later of the Arigato Autoresponder and Newsletter WordPress plugin.
- collector/nvd-index
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/author
- agent/severity
- agent/last-modified-date
- agent/title
- agent/references
- agent/weakness
- agent/tags
- agent/description
- agent/first-publish-date
- agent/event
- vendor/kibokolabs
- canonical/kibokolabs arigato autoresponder and newsletter