What is the CVSS score of CVE-2023-4811?

CVE-2023-4811 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.4%.

Is there a public PoC exploit available for CVE-2023-4811?

Yes, a public proof-of-concept exploit is available for CVE-2023-4811. Prioritise patching immediately. EPSS: 0.4%.

Wordpress File Upload CVE-2023-4811

MEDIUM

2023-10-16 contact@wpscan.com

File Upload WordPress XSS Wordpress File Upload

5.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

CVE Published

Oct 16, 2023 - 20:15 nvd

MEDIUM 5.4

DescriptionNVD

AnalysisAI

The WordPress File Upload WordPress plugin before 4.23.3 does not sanitise and escape some of its settings, which could allow high privilege users such as contributors to perform Stored Cross-Site. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

Technical ContextAI

The WordPress File Upload WordPress plugin before 4.23.3 does not sanitise and escape some of its settings, which could allow high privilege users such as contributors to perform Stored Cross-Site Scripting attacks. Affected products include: Iptanus Wordpress File Upload. Version information: before 4.23.3.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Wordpress File Upload

View all

CVE-2024-9047 CRITICAL Act Now POC

9.8 Oct 12

The WordPress File Upload plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 4.2

CVE-2020-10564 CRITICAL Act Now POC

9.8 Mar 13

An issue was discovered in the File Upload plugin before 4.13.0 for WordPress. Rated critical severity (CVSS 9.8), this

CVE-2024-6494 MEDIUM This Month POC

6.1 Aug 07

The WordPress File Upload WordPress plugin before 4.24.8 does not properly sanitize and escape certain parameters, which

CVE-2024-6651 MEDIUM This Month POC

6.1 Aug 06

The WordPress File Upload WordPress plugin before 4.24.8 does not sanitise and escape a parameter before outputting it b

CVE-2018-9844 MEDIUM This Month POC

6.1 Apr 07

The Iptanus WordPress File Upload plugin before 4.3.4 for WordPress mishandles Settings attributes, leading to XSS. Rate

CVE-2018-9172 MEDIUM This Month POC

5.4 Apr 01

The Iptanus WordPress File Upload plugin before 4.3.3 for WordPress mishandles shortcode attributes. Rated medium severi

CVE-2014-5199 MEDIUM This Month

6.8 Aug 12

Cross-site request forgery (CSRF) vulnerability in the WordPress File Upload plugin (wp-file-upload) before 2.4.2 for Wo

CVE-2024-2847 MEDIUM This Month

6.4 Apr 09

The WordPress File Upload plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s

CVE-2024-7301 MEDIUM This Month

6.1 Aug 16

The WordPress File Upload plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all

CVE-2023-2688 MEDIUM This Month

4.9 Jun 09

The WordPress File Upload and WordPress File Upload Pro plugins for WordPress are vulnerable to Path Traversal in versio

CVE-2023-2767 MEDIUM This Month

4.4 Jun 09

The WordPress File Upload and WordPress File Upload Pro plugins for WordPress are vulnerable to Stored Cross-Site Script

CVE-2024-5852 MEDIUM This Month

4.3 Jul 16

The WordPress File Upload plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including

Same technique File Upload

View all

CVE-2016-3088 CRITICAL POC

9.8

CVE-2017-12617 HIGH POC

8.1

CVE-2017-11357 CRITICAL POC

9.8

CVE-2017-12615 HIGH POC

8.1

CVE-2024-5084 CRITICAL POC

9.8

CVE-2016-6600 CRITICAL POC

9.8

CVE-2017-6090 HIGH POC

8.8

CVE-2015-8249 CRITICAL POC

9.8

CVE-2023-4811 vulnerability details – vuln.today

Back