CVE Catalog
CVE-2023-35878
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk0.34%
25th percentile - higher than 25% of all known CVEs
Summary
The Extra User Details plugin by Vadym K. in versions up to 0.5 has a stored Cross-Site Scripting (XSS) vulnerability with authentication (admin+).
Risk Assessment
An attacker with administrative access can inject malicious code that will be executed in users' browsers, potentially leading to data theft or session hijacking.
Recommendation
It is recommended to update the plugin to the latest version to mitigate this vulnerability and review the permissions of users with administrative access.
Original NVD description (English source)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Vadym K. Extra User Details plugin <= 0.5 versions.