CVE-2023-4148: Ditty < 3.1.25 - Reflected XSS
Published Sep 25, 2023
·Updated
The Ditty WordPress plugin before 3.1.25 does not sanitise and escape some parameters and generated URLs before outputting them back in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Affected Software
1 affected component
metaphorcreations Ditty Wordpress<3.1.25
Event History
Sep 25, 2023
CVE Published
via MITRE·03:56 PM
Data Sourced
via MITRE·03:56 PM
DescriptionWeakness
Data Sourced
via NVD·04:15 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the vulnerability ID of the Ditty WordPress plugin vulnerability?
The vulnerability ID of the Ditty WordPress plugin vulnerability is CVE-2023-4148.
2
What is the severity level of CVE-2023-4148?
The severity level of CVE-2023-4148 is medium.
3
What software is affected by CVE-2023-4148?
The affected software is the Ditty WordPress plugin before version 3.1.25.
4
What is the CWE number of CVE-2023-4148?
The CWE number of CVE-2023-4148 is 79.
5
How can the Ditty WordPress plugin vulnerability be exploited?
The vulnerability can be exploited through Reflected Cross-Site Scripting attacks, which could be used against high privilege users such as admin.