CVE-2023-3170

The tagDiv Composer WordPress plugin before 4.2, used as a companion by the Newspaper and Newsmag themes from tagDiv, does not validate and escape some settings, which could allow users with Admin privileges to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Configurations

Configuration 1 (hide)

cpe:2.3:a:tagdiv:tagdiv_composer:*:*:*:*:*:wordpress:*:*

History

21 Nov 2024, 08:16

Type Values Removed Values Added
References () https://wpscan.com/vulnerability/e95ff3c6-283b-4e5e-bea0-1f1375da08da - Exploit, Third Party Advisory () https://wpscan.com/vulnerability/e95ff3c6-283b-4e5e-bea0-1f1375da08da - Exploit, Third Party Advisory

26 Sep 2024, 16:35

Type Values Removed Values Added
New CVE

Information

Published : 2023-09-11 20:15

Updated : 2024-11-21 08:16


NVD link : CVE-2023-3170

Mitre link : CVE-2023-3170

CVE.ORG link : CVE-2023-3170


JSON object : View

Products Affected

tagdiv

  • tagdiv_composer
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')