WordPress CVEs

Description

The WP Helper Lite WordPress plugin, in versions < 4.3, returns all GET parameters unsanitized in the response, resulting in a reflected cross-site scripting vulnerability.

Affected WordPress components

• WP Helper Premium Plugin · wp-helper-lite
  Confirmed match Active
  Version All versions prior to version 4.3
  View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

• n/a WP Helper Lite Wordpress Plugin — Version All versions prior to version 4.3
• matbao wp_helper_premium — Before 4.3

References

• www.tenable.com https://www.tenable.com/security/research/tra-2023-3 Exploit, Third Party Advisory
• nvd.nist.gov Official NVD record