What the vulnerability does
01Description
A vulnerability, which was classified as problematic, has been found in View All Posts Page Plugin up to 0.9.0 on WordPress. This issue affects the function action_admin_notices_activation of the file view-all-posts-pages.php. The manipulation leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 0.9.1 is able to address this issue. The patch is named bf914f3a59063fa4df8fd4925ae18a5d852396d7. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-233363.
Explanation of Vulnerability in Simple Terms
02Summary
The View All Posts Page plugin contains a stored cross-site scripting (XSS) vulnerability that allows authenticated users to inject malicious scripts into the plugin's output. An attacker with low-level WordPress access can craft a malicious post or page that executes JavaScript in the browsers of site visitors. The vulnerability requires user interaction to trigger and does not affect site confidentiality or availability.
What an attacker can do
03Attacker Capabilities
Inject JavaScript that runs in visitors' browsers when they view affected pages.
Potential impact on your site
04Site Impact
Malicious scripts can steal visitor cookies, redirect users, or deface page content for anyone viewing affected posts.
Conditions required to exploit
05Prerequisites
Attacker must have low-level WordPress user account (e.g., contributor or author); victim must view the affected page.
Key dates
06Disclosure timeline
July 10, 2023
CVE published
August 6, 2024
Record updated
