CVE-2023-0154: falha de média gravidade em GamiPress
GamiPress – Vimeo integration < 1.0.9 - Contributor+ Stored XSS
Publicada em · Atualizada em
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.4epss 0.7%
probabilidade de exploração
0.7%top 48% das CVEs
exploração observada
nãonenhuma fonte reporta
The GamiPress WordPress plugin before 1.0.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Produtos afetados
Unknown · GamiPressCVEs relacionadas — GamiPress
No mesmo produto, das mais perigosas para as menos.
CVE-2024-2505HIGHGamiPress < 6.8.9 - Broken Access ControlEPSS 0.6%CVE-2026-107320MEDIUMGamiPress 7.9.5 - 8.0.5 - Unauthenticated Private Activity Log DisclosureEPSS 0.3%CVE-2026-107319MEDIUMGamiPress < 8.0.6 - Subscriber+ Activity Log DisclosureEPSS 0.3%CVE-2026-77764MEDIUMGamiPress < 7.9.9.6 - Subscriber+ Arbitrary User Points and Achievement Award via Watch-Video ListenersEPSS 0.3%CVE-2024-8245MEDIUMGamiPress - Reset User <= 1.0.0 - GamiPress User Data Removal via CSRFEPSS 0.2%