CVE-2023-6141: Essential Real Estate < 4.4.0 - Subscriber+ Stored XSS
Published Jan 8, 2024
·Updated
The Essential Real Estate WordPress plugin before 4.4.0 does not apply proper capability checks on its AJAX actions, which among other things, allow attackers with a subscriber account to conduct Stored XSS attacks.
Affected Software
1 affected component
G5plus Essential Real Estate Wordpress<4.4.0
Event History
Jan 8, 2024
CVE Published
via MITRE·07:00 PM
Data Sourced
via MITRE·07:00 PM
DescriptionWeakness
Data Sourced
via NVD·07:15 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2023-6141?
CVE-2023-6141 has a moderate severity level due to the potential for Stored XSS attacks.
2
How do I fix CVE-2023-6141?
To fix CVE-2023-6141, update the Essential Real Estate WordPress plugin to version 4.4.0 or later.
3
Who is affected by CVE-2023-6141?
CVE-2023-6141 affects all installations of the Essential Real Estate WordPress plugin prior to version 4.4.0.
4
What type of vulnerability is CVE-2023-6141?
CVE-2023-6141 is a Stored Cross-Site Scripting (XSS) vulnerability.
5
Can an attacker exploit CVE-2023-6141 without special privileges?
Yes, an attacker with a subscriber account can exploit CVE-2023-6141 to conduct Stored XSS attacks.