CVE-2023-2119: XSS
First published: Tue Apr 18 2023(Updated: )
The Responsive Filterable Portfolio plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the search_term parameter in versions up to, and including, 1.0.19 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| I Thirteen Web Solution Responsive Filterable Portfolio | <=1.0.19 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://plugins.trac.wordpress.org/browser/wp-responsive-thumbnail-slider/trunk/wp-responsive-images-thumbnail-slider.php
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2808922%40responsive-filterable-portfolio%2Ftags%2F1.0.19&new=2899431%40responsive-filterable-portfolio%2Ftags%2F1.0.20
- https://www.wordfence.com/threat-intel/vulnerabilities/id/e67dfe0f-ac1c-4a78-bfc9-0cfd6c3040d4?source=cve
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2023-2119.
What is the title of the vulnerability?
The title of the vulnerability is 'The Responsive Filterable Portfolio plugin for WordPress is vulnerable to Reflected Cross-Site Scripting'.
What is the severity of CVE-2023-2119?
The severity of CVE-2023-2119 is medium.
What is the affected software for CVE-2023-2119?
The affected software for CVE-2023-2119 is the Responsive Filterable Portfolio plugin for WordPress, versions up to and including 1.0.19.
How can the vulnerability CVE-2023-2119 be exploited?
CVE-2023-2119 can be exploited by unauthenticated attackers injecting malicious code through the search_term parameter of the plugin.
- agent/type
- agent/softwarecombine
- agent/references
- agent/weakness
- agent/severity
- agent/author
- agent/first-publish-date
- agent/event
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/i13websolution
- canonical/i thirteen web solution responsive filterable portfolio
- version/i thirteen web solution responsive filterable portfolio/1.0.19