CVE-2023-5560: WP-UserOnline < 2.88.3 - Unauthenticated Stored XSS
First published: Mon Nov 27 2023(Updated: )
The WP-UserOnline WordPress plugin before 2.88.3 does not sanitise and escape the X-Forwarded-For header before outputting its content on the page, which allows unauthenticated users to perform Cross-Site Scripting attacks.
Credit: contact@wpscan.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Lesterchan Wp-useronline | <2.88.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the severity of CVE-2023-5560?
The severity of CVE-2023-5560 is medium, with a CVSS score of 6.1.
How does CVE-2023-5560 affect the WP-UserOnline plugin?
CVE-2023-5560 affects the WP-UserOnline plugin version up to and excluding 2.88.3.
What is the vulnerability in WP-UserOnline plugin (CVE-2023-5560) about?
CVE-2023-5560 is an unauthenticated stored XSS vulnerability in the WP-UserOnline plugin.
How can an unauthenticated user exploit CVE-2023-5560?
An unauthenticated user can exploit CVE-2023-5560 by injecting malicious scripts through the X-Forwarded-For header.
Is there a fix available for CVE-2023-5560?
Yes, updating the WP-UserOnline plugin to version 2.88.3 or higher fixes CVE-2023-5560.
- collector/nvd-api
- agent/severity
- agent/title
- agent/weakness
- agent/references
- agent/author
- agent/type
- agent/event
- agent/description
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/lesterchan
- canonical/lesterchan wp-useronline