CVE-2023-0603

The Sloth Logo Customizer WordPress plugin through 2.0.2 does not have CSRF check when updating its settings, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
8.8 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
WPScanCNA
---
---
CVEADP
---
---
CISA-ADPADP
8.8 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 94%
VendorProductVersion
sloth_logo_customizer_projectsloth_logo_customizer
𝑥
≤ 2.0.2
𝑥
= Vulnerable software versions
References
https://wpscan.com/vulnerability/1c93ea8f-4e68-4da1-994e-35a5873278ba
https://wpscan.com/vulnerability/1c93ea8f-4e68-4da1-994e-35a5873278ba