CVE-2023-2309

Description

The wpForo Forum WordPress plugin before 2.1.9 does not escape some request parameters while in debug mode, leading to a Reflected Cross-Site Scripting vulnerability.

Reserved 2023-04-26 | Published 2023-07-24 | Updated 2024-10-24 | Assigner WPScan

Problem types

CWE-79 Cross-Site Scripting (XSS)

Product status

Default status
unaffected

Any version before 2.1.9
affected

Credits

Alex Sanford finder

WPScan coordinator

References

wpscan.com/...erability/1b3f4558-ea41-4749-9aa2-d3971fc9ca0d exploit vdb-entry technical-description

cve.org (CVE-2023-2309)

nvd.nist.gov (CVE-2023-2309)

Download JSON