What is the CVSS score of CVE-2023-29385?

CVE-2023-29385 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by CVE-2023-29385?

Organizations using Kevon Adonis WP Abstracts plugin face moderate risk from CVE-2023-29385, a cross-site scripting vulnerability rated CVSS 7.1.

How to fix or mitigate CVE-2023-29385?

Within 7 days: Identify all affected systems running Kevon Adonis WP Abstracts plugin and apply vendor patches promptly. Verify anti-CSRF tokens and content security policies are enforced.

PHP CVE-2023-29385

HIGH

Cross-site Scripting (XSS) (CWE-79)

2023-06-12 audit@patchstack.com

XSS WordPress PHP Wp Abstracts

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Mar 13, 2026 - 20:30 vuln.today

CVE Published

Jun 12, 2023 - 16:15 nvd

HIGH 7.1

DescriptionCVE.org

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Kevon Adonis WP Abstracts plugin <= 2.6.2 versions.

AnalysisAI

The WP Abstracts plugin for WordPress (versions <= 2.6.2) contains an unauthenticated reflected Cross-Site Scripting (XSS) vulnerability that allows remote attackers to execute malicious JavaScript in users' browsers. With an EPSS score of 0.10% (28th percentile), this vulnerability has relatively low exploitation activity in the wild and is not currently listed in CISA's KEV catalog.

Technical ContextAI

The vulnerability affects the WP Abstracts Manuscripts Manager plugin (CPE: cpe:2.3:a:kevonadonis:wp_abstracts:*:*:*:*:free:wordpress:*:*) developed by Kevon Adonis. As a CWE-79 (Improper Neutralization of Input During Web Page Generation) vulnerability, the plugin fails to properly sanitize user-supplied input before reflecting it back in the HTML response. This allows attackers to inject malicious scripts that execute in the context of the victim's browser session when they visit a specially crafted URL.

RemediationAI

Update the WP Abstracts plugin to version 2.6.3 or later, which presumably contains the fix for this vulnerability. If immediate patching is not possible, consider temporarily disabling the plugin or implementing Web Application Firewall (WAF) rules to filter XSS payloads. The Patchstack database links provided in the references should contain additional details about the patch, though specific patch information is not explicitly mentioned in the available data.