CVE-2023-3118
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
The Export All URLs plugin for WordPress before version 4.6 does not sanitize and escape a parameter before outputting it back on the page, leading to a Reflected Cross-Site Scripting vulnerability.
Risk Assessment
An attacker could exploit this vulnerability to perform XSS attacks against high privilege users, such as administrators, potentially leading to account takeover or data theft.
Recommendation
It is recommended to update the Export All URLs plugin to version 4.6 or later to mitigate this vulnerability.
Original NVD description (English source)
The Export All URLs WordPress plugin before 4.6 does not sanitise and escape a parameter before outputting them back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin