CVE-2023-28174: WordPress eRocket Plugin <= 1.2.4 is vulnerable to Cross Site Scripting (XSS)
Published Jun 22, 2023
·Updated
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in eLightUp eRocket plugin <= 1.2.4 versions.
Affected Software
1 affected component
eLightUp Erocket Wordpress<=1.2.4
Remediation
Information
Update to 1.2.5 or a higher version.
Event History
Jun 22, 2023
CVE Published
via MITRE·11:59 AM
Data Sourced
via MITRE·11:59 AM
RemedyDescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2023-28174?
CVE-2023-28174 has been classified as a high severity vulnerability due to its potential for exploitation.
2
How do I fix CVE-2023-28174?
The recommended fix for CVE-2023-28174 is to update the eLightUp eRocket plugin to version 1.2.5 or later.
3
What types of attacks can CVE-2023-28174 enable?
CVE-2023-28174 can enable attackers to perform stored Cross-Site Scripting (XSS) attacks.
4
Who is affected by CVE-2023-28174?
CVE-2023-28174 affects users of the eLightUp eRocket plugin version 1.2.4 and below on WordPress.
5
Is user authentication required to exploit CVE-2023-28174?
Yes, CVE-2023-28174 requires user authentication to be exploited, specifically by admin-level users.