How to fix CVE-2023-29385?

Within 7 days: Identify all affected systems running Kevon Adonis WP Abstracts plugin and apply vendor patches promptly. Verify anti-CSRF tokens and content security policies are enforced.

Is PHP affected by CVE-2023-29385?

Organizations using Kevon Adonis WP Abstracts plugin face moderate risk from CVE-2023-29385, a cross-site scripting vulnerability rated CVSS 7.1. Attackers could inject malicious scripts to steal user sessions, credentials, or perform actions on behalf of authenticated users.

CVE-2023-29385

HIGH

2023-06-12 [email protected]

XSS WordPress PHP Wp Abstracts

7.1

CVSS 3.1

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Mar 13, 2026 - 20:30 vuln.today

CVE Published

Jun 12, 2023 - 16:15 nvd

HIGH 7.1

DescriptionNVD

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Kevon Adonis WP Abstracts plugin <= 2.6.2 versions.

AnalysisAI

The WP Abstracts plugin for WordPress (versions <= 2.6.2) contains an unauthenticated reflected Cross-Site Scripting (XSS) vulnerability that allows remote attackers to execute malicious JavaScript in users' browsers. With an EPSS score of 0.10% (28th percentile), this vulnerability has relatively low exploitation activity in the wild and is not currently listed in CISA's KEV catalog.

Technical ContextAI

The vulnerability affects the WP Abstracts Manuscripts Manager plugin (CPE: cpe:2.3:a:kevonadonis:wp_abstracts:*:*:*:*:free:wordpress:*:*) developed by Kevon Adonis. As a CWE-79 (Improper Neutralization of Input During Web Page Generation) vulnerability, the plugin fails to properly sanitize user-supplied input before reflecting it back in the HTML response. This allows attackers to inject malicious scripts that execute in the context of the victim's browser session when they visit a specially crafted URL.

RemediationAI

Update the WP Abstracts plugin to version 2.6.3 or later, which presumably contains the fix for this vulnerability. If immediate patching is not possible, consider temporarily disabling the plugin or implementing Web Application Firewall (WAF) rules to filter XSS payloads. The Patchstack database links provided in the references should contain additional details about the patch, though specific patch information is not explicitly mentioned in the available data.

CVE-2023-29385 vulnerability details – vuln.today

Back