The WP VR WordPress plugin before 8.3.15 does not authorisation and CSRF in a function hooked to admin_init, allowing unauthenticated users to downgrade the plugin, thus leading to Reflected or Stored XSS, as previous versions have such vulnerabilities.
References
Link | Resource |
---|---|
https://wpscan.com/vulnerability/c36314c1-a2c0-4816-93c9-e61f9cf7f27a | Third Party Advisory |
Configurations
History
11 Jan 2024, 20:03
Type | Values Removed | Values Added |
---|---|---|
CPE | cpe:2.3:a:coderex:wp_vr:*:*:*:*:*:wordpress:*:* | |
First Time |
Coderex wp Vr
Coderex |
|
CWE | CWE-352 CWE-79 |
|
CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.1 |
References | () https://wpscan.com/vulnerability/c36314c1-a2c0-4816-93c9-e61f9cf7f27a - Third Party Advisory |
08 Jan 2024, 19:30
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2024-01-08 19:15
Updated : 2024-02-28 20:54
NVD link : CVE-2023-6529
Mitre link : CVE-2023-6529
CVE.ORG link : CVE-2023-6529
JSON object : View
Products Affected
coderex
- wp_vr