CVE-2023-2362
Description
The Float menu WordPress plugin before 5.0.2, Bubble Menu WordPress plugin before 3.0.4, Button Generator WordPress plugin before 2.3.5, Calculator Builder WordPress plugin before 1.5.1, Counter Box WordPress plugin before 1.2.2, Floating Button WordPress plugin before 5.3.1, Herd Effects WordPress plugin before 5.2.2, Popup Box WordPress plugin before 2.2.2, Side Menu Lite WordPress plugin before 4.0.2, Sticky Buttons WordPress plugin before 3.1.1, Wow Skype Buttons WordPress plugin before 4.0.2, WP Coder WordPress plugin before 2.5.6 do not escape the page parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
How to fix
- wow-company bubble_menu3.0.4 or later
- wow-company button_generator2.3.5 or later
- wow-company calculator-builder1.5.1 or later
- wow-company counter_box1.2.2 or later
- wow-company float_menu5.0.2 or later
- wow-company floating_button5.3.1 or later
- wow-company herd_effects5.2.2 or later
- wow-company popup_box2.2.2 or later
- wow-company side_menu_lite4.0.2 or later
- wow-company sticky_buttons3.1.1 or later
- wow-company wow_skype_buttons4.0.2 or later
- wow-company wp_coder2.5.6 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| wow-company bubble_menu | v < 3.0.4 | 3.0.4 |
| wow-company button_generator | v < 2.3.5 | 2.3.5 |
| wow-company calculator-builder | v < 1.5.1 | 1.5.1 |
| wow-company counter_box | v < 1.2.2 | 1.2.2 |
| wow-company float_menu | v < 5.0.2 | 5.0.2 |
| wow-company floating_button | v < 5.3.1 | 5.3.1 |
| wow-company herd_effects | v < 5.2.2 | 5.2.2 |
| wow-company popup_box | v < 2.2.2 | 2.2.2 |
| wow-company side_menu_lite | v < 4.0.2 | 4.0.2 |
| wow-company sticky_buttons | v < 3.1.1 | 3.1.1 |
| wow-company wow_skype_buttons | v < 4.0.2 | 4.0.2 |
| wow-company wp_coder | v < 2.5.6 | 2.5.6 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.