CVE-2023-0603

high · 8.8

The Sloth Logo Customizer WordPress plugin through 2.0.2 does not have CSRF check when updating its settings, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack

8.8

CVSS

13.9%

EPSS (exploit prob.)

96th

EPSS percentile

2023-05-08

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

Vendor	Product	Affected versions
sloth_logo_customizer_project	sloth_logo_customizer	<= 2.0.2

Check a specific version with /api/v1/cve/match.

References

https://wpscan.com/vulnerability/1c93ea8f-4e68-4da1-994e-35a5873278ba
https://wpscan.com/vulnerability/1c93ea8f-4e68-4da1-994e-35a5873278ba

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2023-0603