fkie_nvd - fkie_cve-2023-2362

FKIE_CVE-2023-2362

Vulnerability from fkie_nvd - Published: 2023-06-12 18:15 - Updated: 2025-05-05 16:15

Severity ?

6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Summary

The Float menu WordPress plugin before 5.0.2, Bubble Menu WordPress plugin before 3.0.4, Button Generator WordPress plugin before 2.3.5, Calculator Builder WordPress plugin before 1.5.1, Counter Box WordPress plugin before 1.2.2, Floating Button WordPress plugin before 5.3.1, Herd Effects WordPress plugin before 5.2.2, Popup Box WordPress plugin before 2.2.2, Side Menu Lite WordPress plugin before 4.0.2, Sticky Buttons WordPress plugin before 3.1.1, Wow Skype Buttons WordPress plugin before 4.0.2, WP Coder WordPress plugin before 2.5.6 do not escape the page parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

References

	URL	Tags
	contact@wpscan.com	https://wpscan.com/vulnerability/27e70507-fd68-4915-88cf-0b96ed55208e	Exploit, Third Party Advisory
	af854a3a-2127-422b-91ae-364da2661108	https://wpscan.com/vulnerability/27e70507-fd68-4915-88cf-0b96ed55208e	Exploit, Third Party Advisory

Impacted products

Vendor	Product	Version
wow-company	bubble_menu	*
wow-company	button_generator	*
wow-company	calculator-builder	*
wow-company	counter_box	*
wow-company	float_menu	*
wow-company	floating_button	*
wow-company	herd_effects	*
wow-company	popup_box	*
wow-company	side_menu_lite	*
wow-company	sticky_buttons	*
wow-company	wow_skype_buttons	*
wow-company	wp_coder	*

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:wow-company:bubble_menu:*:*:*:*:free:wordpress:*:*",
              "matchCriteriaId": "10AD596E-1B52-46B1-829C-5EB9F0ADE05B",
              "versionEndExcluding": "3.0.4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:wow-company:button_generator:*:*:*:*:*:wordpress:*:*",
              "matchCriteriaId": "806682E4-9A5A-403B-A76B-802FB3B41C66",
              "versionEndExcluding": "2.3.5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:wow-company:calculator-builder:*:*:*:*:*:wordpress:*:*",
              "matchCriteriaId": "D6220023-E6F2-483F-9CE2-013D890995D5",
              "versionEndExcluding": "1.5.1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:wow-company:counter_box:*:*:*:*:*:wordpress:*:*",
              "matchCriteriaId": "23960112-FEDC-4764-96D7-228A419A808B",
              "versionEndExcluding": "1.2.2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:wow-company:float_menu:*:*:*:*:*:wordpress:*:*",
              "matchCriteriaId": "F7D2CE4E-1EBF-4794-B65F-6882455C7008",
              "versionEndExcluding": "5.0.2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:wow-company:floating_button:*:*:*:*:*:wordpress:*:*",
              "matchCriteriaId": "3DF4E9D8-370D-4D26-B5F7-0AE1D23E05A3",
              "versionEndExcluding": "5.3.1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:wow-company:herd_effects:*:*:*:*:*:wordpress:*:*",
              "matchCriteriaId": "FB9BB076-C3BD-43F2-96F4-8AFDCE1D86C1",
              "versionEndExcluding": "5.2.2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:wow-company:popup_box:*:*:*:*:*:wordpress:*:*",
              "matchCriteriaId": "04B04B96-CDA8-4EB5-A594-EA7277734D30",
              "versionEndExcluding": "2.2.2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:wow-company:side_menu_lite:*:*:*:*:*:wordpress:*:*",
              "matchCriteriaId": "5172A612-C0A7-4563-ACAD-33B0A1D03601",
              "versionEndExcluding": "4.0.2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:wow-company:sticky_buttons:*:*:*:*:*:wordpress:*:*",
              "matchCriteriaId": "91B1163A-C832-46C6-B6BC-BE519E80AB86",
              "versionEndExcluding": "3.1.1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:wow-company:wow_skype_buttons:*:*:*:*:*:wordpress:*:*",
              "matchCriteriaId": "0C54D4CB-6C7E-4928-A018-4C3511F9E1C2",
              "versionEndExcluding": "4.0.2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:wow-company:wp_coder:*:*:*:*:*:wordpress:*:*",
              "matchCriteriaId": "462DB077-1F11-4DD3-B42B-E2664842EE74",
              "versionEndExcluding": "2.5.6",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Float menu WordPress plugin before 5.0.2, Bubble Menu WordPress plugin before 3.0.4, Button Generator WordPress plugin before 2.3.5, Calculator Builder WordPress plugin before 1.5.1, Counter Box WordPress plugin before 1.2.2, Floating Button WordPress plugin before 5.3.1, Herd Effects WordPress plugin before 5.2.2, Popup Box WordPress plugin before 2.2.2, Side Menu Lite WordPress plugin before 4.0.2, Sticky Buttons WordPress plugin before 3.1.1, Wow Skype Buttons WordPress plugin before 4.0.2, WP Coder WordPress plugin before 2.5.6 do not escape the page parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin"
    }
  ],
  "id": "CVE-2023-2362",
  "lastModified": "2025-05-05T16:15:35.577",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.7,
        "source": "nvd@nist.gov",
        "type": "Primary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.7,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ]
  },
  "published": "2023-06-12T18:15:09.973",
  "references": [
    {
      "source": "contact@wpscan.com",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://wpscan.com/vulnerability/27e70507-fd68-4915-88cf-0b96ed55208e"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://wpscan.com/vulnerability/27e70507-fd68-4915-88cf-0b96ed55208e"
    }
  ],
  "sourceIdentifier": "contact@wpscan.com",
  "vulnStatus": "Modified"
}

CVE-2023-2362 (GCVE-0-2023-2362)

Vulnerability from cvelistv5 – Published: 2023-06-12 17:28 – Updated: 2025-05-05 16:01

Title

Multiple Plugins from Wow-Company - Reflected XSS

Summary

Severity ?

6.1 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CWE

CWE-79 Cross-Site Scripting (XSS)

Assigner

WPScan

References

URL

Tags

https://wpscan.com/vulnerability/27e70507-fd68-49…

exploitvdb-entrytechnical-description

Impacted products

Vendor

Product

Version

Unknown

Float menu

Affected: 0 , < 5.0.2 (custom)

Unknown	Bubble Menu	Affected: 0 , < 3.0.4 (custom)
Unknown	Button Generator	Affected: 0 , < 2.3.5 (custom)
Unknown	Calculator Builder	Affected: 0 , < 1.5.1 (custom)
Unknown	Counter Box	Affected: 0 , < 1.2.2 (custom)
Unknown	Floating Button	Affected: 0 , < 5.3.1 (custom)
Unknown	Herd Effects	Affected: 0 , < 5.2.2 (custom)
Unknown	Popup Box	Affected: 0 , < 2.2.2 (custom)
Unknown	Side Menu Lite	Affected: 0 , < 4.0.2 (custom)
Unknown	Sticky Buttons	Affected: 0 , < 3.1.1 (custom)
Unknown	Wow Skype Buttons	Affected: 0 , < 4.0.2 (custom)
Unknown	WP Coder	Affected: 0 , < 2.5.6 (custom)

Credits

Erwan LR (WPScan) WPScan

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T06:19:14.896Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "exploit",
              "vdb-entry",
              "technical-description",
              "x_transferred"
            ],
            "url": "https://wpscan.com/vulnerability/27e70507-fd68-4915-88cf-0b96ed55208e"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 6.1,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "CHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2023-2362",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-23T13:30:01.682498Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-05T16:01:12.174Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "product": "Float menu",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "5.0.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "product": "Bubble Menu",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "3.0.4",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "product": "Button Generator",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "2.3.5",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "product": "Calculator Builder",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "1.5.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "product": "Counter Box",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "1.2.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "product": "Floating Button",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "5.3.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "product": "Herd Effects",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "5.2.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "product": "Popup Box",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "2.2.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "product": "Side Menu Lite",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "4.0.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "product": "Sticky Buttons",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "3.1.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "product": "Wow Skype Buttons",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "4.0.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "product": "WP Coder",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "2.5.6",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Erwan LR (WPScan)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Float menu WordPress plugin before 5.0.2, Bubble Menu WordPress plugin before 3.0.4, Button Generator WordPress plugin before 2.3.5, Calculator Builder WordPress plugin before 1.5.1, Counter Box WordPress plugin before 1.2.2, Floating Button WordPress plugin before 5.3.1, Herd Effects WordPress plugin before 5.2.2, Popup Box WordPress plugin before 2.2.2, Side Menu Lite WordPress plugin before 4.0.2, Sticky Buttons WordPress plugin before 3.1.1, Wow Skype Buttons WordPress plugin before 4.0.2, WP Coder WordPress plugin before 2.5.6 do not escape the page parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-79 Cross-Site Scripting (XSS)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-06-12T17:28:22.661Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/27e70507-fd68-4915-88cf-0b96ed55208e"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Multiple Plugins from Wow-Company - Reflected XSS",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2023-2362",
    "datePublished": "2023-06-12T17:28:22.661Z",
    "dateReserved": "2023-04-28T10:05:48.876Z",
    "dateUpdated": "2025-05-05T16:01:12.174Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

FKIE_CVE-2023-2362

CVE-2023-2362 (GCVE-0-2023-2362)

Tags

Sightings

Nomenclature