{"id":"CVE-2023-0423","aliases":["EUVD-2023-12480","GHSA-f58q-53c2-cjqm"],"status":"published","title":"WordPress Amazon S3 Plugin \u003c 1.6 - Reflected XSS","description":"The WordPress Amazon S3 Plugin WordPress plugin before 1.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin","severity":{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.00442,"percentile":0.38778,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2023-04-10T13:18:02Z","modified":"2026-06-17T05:25:31Z","products":[{"vendor":"unknown","product":"wordpress amazon s3 plugin"},{"vendor":"wordpress_amazon_s3_project","product":"wordpress_amazon_s3"}],"references":[{"url":"https://wpscan.com/vulnerability/73d588d7-26ae-42e2-8282-aa02bcb109b6","tags":["exploit","vdb-entry","technical-description","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-0423"},{"url":"https://github.com/advisories/GHSA-f58q-53c2-cjqm"}],"sources":{"cve":[{"id":"CVE-2023-0423","title":"WordPress Amazon S3 Plugin \u003c 1.6 - Reflected XSS","description":"The WordPress Amazon S3 Plugin WordPress plugin before 1.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin","status":"published","published":"2023-04-10T13:18:02.898Z","modified":"2025-02-11T21:18:03.509Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"updated_at":"2026-11-02T14:35:34.923818Z"}],"euvd":[{"id":"EUVD-2023-12480","description":"The WordPress Amazon S3 Plugin WordPress plugin before 1.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin","status":"published","published":"2023-04-10T13:18:02Z","modified":"2025-02-11T21:18:03Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T00:03:58.784175Z"}],"ghsa":[{"id":"GHSA-f58q-53c2-cjqm","title":"The WordPress Amazon S3 Plugin WordPress plugin before 1.6 does not sanitise and escape a...","description":"The WordPress Amazon S3 Plugin WordPress plugin before 1.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin","status":"published","published":"2023-04-10T15:30:25Z","modified":"2023-04-22T05:08:15Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:54:33.425205Z"}],"nvd":[{"id":"CVE-2023-0423","description":"The WordPress Amazon S3 Plugin WordPress plugin before 1.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin","status":"published","published":"2023-04-10T14:15:08.35Z","modified":"2026-06-17T05:25:31.11Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"updated_at":"2026-11-02T14:07:53.719171Z"}]}}