CVE-2023-0603

EUVD-2023-12641
The Sloth Logo Customizer WordPress plugin through 2.0.2 does not have CSRF check when updating its settings, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.8 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CISA-ADPADP
8.8 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 92%
Affected Products (NVD)
VendorProductVersion
sloth_logo_customizer_projectsloth_logo_customizer
𝑥
≤ 2.0.2
𝑥
= Vulnerable software versions
References
https://wpscan.com/vulnerability/1c93ea8f-4e68-4da1-994e-35a5873278ba
https://wpscan.com/vulnerability/1c93ea8f-4e68-4da1-994e-35a5873278ba