CVE-2023-52175: WordPress Auto Amazon Links Plugin <= 5.1.1 is vulnerable to Cross Site Scripting (XSS)
First published: Thu Feb 01 2024(Updated: )
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Michael Uno (miunosoft) Auto Amazon Links – Amazon Associates Affiliate Plugin allows Stored XSS.This issue affects Auto Amazon Links – Amazon Associates Affiliate Plugin: from n/a through 5.1.1.
Credit: audit@patchstack.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Michaeluno Auto Amazon Links Wordpress | <5.1.2 |
Remedy
Update to 5.1.2 or a higher version.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the severity of CVE-2023-52175?
CVE-2023-52175 is classified as a high-severity vulnerability due to its potential for exploitation through stored cross-site scripting (XSS).
How do I fix CVE-2023-52175?
To mitigate CVE-2023-52175, users should update the Auto Amazon Links – Amazon Associates Affiliate Plugin to version 5.1.3 or later where the vulnerability has been fixed.
What types of attacks can exploit CVE-2023-52175?
CVE-2023-52175 can be exploited through stored XSS attacks, allowing attackers to inject malicious scripts into web pages viewed by users.
Who is affected by CVE-2023-52175?
CVE-2023-52175 affects users of the Auto Amazon Links – Amazon Associates Affiliate Plugin version 5.1.2 and earlier on WordPress installations.
What should I do if I cannot update due to compatibility issues with CVE-2023-52175?
If immediate updates are not feasible due to compatibility concerns, it is advised to implement additional security measures such as input sanitization or use an alternative plugin until an update is possible.
- agent/remedy
- agent/references
- agent/title
- agent/weakness
- agent/first-publish-date
- agent/type
- agent/description
- agent/author
- agent/event
- agent/severity
- collector/epss-latest
- source/FIRST
- agent/epss
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/michaeluno
- canonical/michaeluno auto amazon links