CVE-2023-3328
Assigner: WPScan
Published: 2023-08-14T19:10:22.342Z
State: PUBLISHED
title: Custom Field For WP Job Manager < 1.2 - Admin+ Stored XSS
problemTypes: descriptions: description: CWE-79 Cross-Site Scripting (XSS)
type: CWE
affected: vendor: Unknown
product: Custom Field For WP Job Manager
versions: status: affected
versionType: custom
version: 0
lessThan: 1.2
defaultStatus: unaffected
collectionURL: https://wordpress.org/plugins
descriptions: value: The Custom Field For WP Job Manager WordPress plugin before 1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
credits: value: Bob Matyas
type: finder
value: WPScan
type: coordinator
source: discovery: EXTERNAL
x_generator: engine: WPScan CVE Generator