.. / CVE-2023-0448

Exploit for WordPress Plugin WP Helper Lite < 4.3 - Cross-Site Scripting (CVE-2023-0448)

Description:

The WP Helper Lite WordPress plugin, in versions < 4.3, returns all GET parameters unsanitized in the response, resulting in a reflected cross-site scripting vulnerability.

Affected Products:

Proof of Concept

PoC exploit

Nuclei Template

View the template here CVE-2023-0448.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2023/CVE-2023-0448.yaml
Copy

References:

https://nvd.nist.gov/vuln/detail/CVE-2023-0448
https://wpscan.com/vulnerability/1f24db34-f608-4463-b4ee-9bc237774256