« Volver al listado

CVE-2023-5140

Estado: ModificadaMedia (6.1)—

The Bonus for Woo WordPress plugin before 5.8.3 does not sanitise and escape some parameters before outputting them back in pages, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Computy — Bonus FOR WOO

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-5140",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "contact@wpscan.com",
      "affectedData": [
        {
          "vendor": "Unknown",
          "product": "Bonus for Woo",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "5.8.3",
              "versionType": "semver"
            }
          ],
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2023-11-20T19:15:09.677",
  "references": [
    {
      "url": "https://wpscan.com/vulnerability/ee1824e8-09a6-4763-b65e-03701dc3e171",
      "tags": [
        "Exploit",
        "Product",
        "Third Party Advisory"
      ],
      "source": "contact@wpscan.com"
    },
    {
      "url": "https://wpscan.com/vulnerability/ee1824e8-09a6-4763-b65e-03701dc3e171",
      "tags": [
        "Exploit",
        "Product",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Bonus for Woo WordPress plugin before 5.8.3 does not sanitise and escape some parameters before outputting them back in pages, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin."
    },
    {
      "lang": "es",
      "value": "El complemento Bonus for Woo para WordPress anterior a 5.8.3 no sanitiza ni escapa algunos parámetros antes de devolverlos a las páginas, lo que genera Cross-Site Scripting Reflejado que podría usarse contra usuarios con altos privilegios, como el administrador."
    }
  ],
  "lastModified": "2026-06-17T06:47:37.793",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:computy:bonus_for_woo:*:*:*:*:*:wordpress:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CBB4B29E-FBE1-4E03-8497-0DE3A4247F07",
              "versionEndExcluding": "5.8.3"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "contact@wpscan.com"
}