Resume Builder by Justin Scheetz

Resume Builder by Justin Scheetz <= 3.1.1 - Subscriber+ Stored XSS

LANACOMMONVDB ID: bd55ff1d-df0e-4e42-b303-9d5ccdfa8f79

The plugin does not sanitize and escape some parameters related to resume, which could allow users with a role as low as subscriber to perform Stored Cross-Site Scripting (XSS) attacks against higher privilege users.

You must be log in to view vulnerability details.

Or register a new account.

References

Source Code: https://wordpress.org/plugins/resume-builder/

CVE: CVE-2023-0078

Attributes

Catgory: WordPress Plugin

Discovered: 2022-12-31

Published: 2023-02-13

Affected Version: <= 3.1.1

Classification

Type: Cross-Site Request Forgery (CSRF), Cross-Site Scripting (XSS), Missing Authorization

Researcher

Name: István Márton

Email: [email protected]

Support Us?

We would truly appreciate it if you bought us a bunny (food for a snow leopard).