CVE-2023-3292
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
The grid-kit-premium WordPress plugin before 2.2.0 does not escape some parameters as well as generated URLs before outputting them in attributes, leading to a vulnerability to Reflected Cross-Site Scripting.
Risk Assessment
An attacker could exploit this vulnerability to perform XSS attacks against high privilege users such as admins, potentially leading to serious security breaches.
Recommendation
It is recommended to update the grid-kit-premium plugin to version 2.2.0 or later to mitigate this vulnerability.
Original NVD description (English source)
The grid-kit-premium WordPress plugin before 2.2.0 does not escape some parameters as well as generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin