CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
Lifecycle Timeline
2DescriptionNVD
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CrestaProject Attesa Extra attesa-extra allows Stored XSS.This issue affects Attesa Extra: from n/a through <= 1.4.7.
AnalysisAI
Stored cross-site scripting (XSS) in CrestaProject Attesa Extra WordPress plugin versions 1.4.7 and earlier allows authenticated users with low privileges to inject malicious scripts that execute in the browsers of other site visitors, potentially compromising session tokens, stealing sensitive data, or performing unauthorized actions. The vulnerability requires user interaction (clicking a malicious link) to trigger the payload, affects confidentiality, integrity, and availability, and carries a moderate CVSS score of 6.5 despite very low EPSS exploitation probability (0.02%, 7th percentile), suggesting limited real-world weaponization despite the vector permitting network-based attacks.
Technical ContextAI
The vulnerability stems from improper input validation and output encoding in the Attesa Extra plugin (CWE-79: Improper Neutralization of Input During Web Page Generation). The plugin fails to sanitize and escape user-supplied input before rendering it in generated web pages, allowing an authenticated attacker with low privileges (PR:L per CVSS vector) to store malicious JavaScript payloads in the application backend. When other users-including administrators-view pages containing the stored payload, the script executes in their browser context with their session privileges. The CVSS vector indicates the attack requires low complexity (AC:L), network accessibility (AV:N), requires authentication (PR:L), and user interaction (UI:R), meaning a victim must be tricked into visiting a page where the payload has been injected.
Affected ProductsAI
CrestaProject Attesa Extra WordPress plugin is affected in versions from an undefined baseline through version 1.4.7. The plugin is identified by WordPress plugin namespace and is hosted in the WordPress plugin repository. No specific CPE string was provided in the source data, but the vulnerability specifically targets the Attesa Extra plugin for WordPress, affecting any installation running version 1.4.7 or earlier. A patched version addressing this issue has been released (per the Patchstack report), and site administrators should verify their current plugin version against the fixed release.
RemediationAI
Update CrestaProject Attesa Extra to the patched version released after 1.4.7, available through the WordPress plugin repository or the vendor's official distribution channel. Site administrators should navigate to Plugins > Installed Plugins in their WordPress dashboard, locate Attesa Extra, and apply the available update immediately. If an update is not yet available at the time of this analysis, disable the plugin temporarily by deactivating it from the Plugins page and limiting plugin functionality until a patched version is released. Review the Patchstack vulnerability database entry (https://patchstack.com/database/Wordpress/Plugin/attesa-extra/vulnerability/wordpress-attesa-extra-plugin-1-4-5-cross-site-scripting-xss-vulnerability?_s_id=cve) for confirmation of the patched version number and additional remediation guidance. Consider restricting low-privilege user roles (contributors, subscribers) from posting or editing content if the plugin allows such permissions, reducing the attack surface until patching is complete.
Share
External POC / Exploit Code
Leaving vuln.today