CVE-2023-3650
MediumCVSS 4.8Exploitation Probability (EPSS)
Low risk46th percentile - higher than 46% of all known CVEs
Summary
The Bubble Menu WordPress plugin before 3.0.5 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Risk Assessment
The organization may be exposed to XSS attacks that could lead to data theft or takeover of high-privilege user accounts.
Recommendation
It is recommended to update the Bubble Menu plugin to version 3.0.5 or later to mitigate the risk associated with this vulnerability.
Original NVD description (English source)
The Bubble Menu WordPress plugin before 3.0.5 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example, in multisite setup).