CVE-2023-2362 is a Reflected Cross-Site Scripting (XSS) vulnerability affecting multiple WordPress plugins developed by "wow_company," including Float menu, Bubble Menu, and WP Coder, all patched in versions prior to their respective updates. This flaw stems from improper sanitization of the 'page' parameter, allowing malicious scripts to be injected and executed in a user's browser. With a CVSS score of 6.1 (Medium), this vulnerability can be exploited remotely with low complexity, requiring user interaction (e.g., clicking a malicious link) to impact high-privilege users like administrators, potentially leading to data theft or unauthorized actions. Currently, there is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 3.0.4CPE matchmatch criteria | cpe:2.3:a:wow-company:bubble_menu:*:*:*:*:free:wordpress:*:* | ||
< 2.3.5CPE matchmatch criteria | cpe:2.3:a:wow-company:button_generator:*:*:*:*:*:wordpress:*:* | ||
< 1.5.1CPE matchmatch criteria | cpe:2.3:a:wow-company:calculator-builder:*:*:*:*:*:wordpress:*:* | ||
< 1.2.2CPE matchmatch criteria | cpe:2.3:a:wow-company:counter_box:*:*:*:*:*:wordpress:*:* | ||
< 5.0.2CPE matchmatch criteria | cpe:2.3:a:wow-company:float_menu:*:*:*:*:*:wordpress:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.