CVE-2023-3936
Published: 21 August 2023
Summary
CVE-2023-3936 is a medium-severity an unspecified weakness vulnerability in Adenion Blog2Social. Its CVSS base score is 6.1 (Medium).
Operationally, ranked in the top 5.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
The Blog2Social WordPress plugin before version 7.2.1 is affected by a reflected cross-site scripting vulnerability. The root cause is a failure to sanitize and escape an unspecified parameter before echoing it back into page output, as described in the CVE record with a CVSS 3.1 score of 6.1.
An unauthenticated attacker can supply a crafted request that triggers script execution when a high-privilege user such as an administrator follows the resulting link. The attack requires user interaction and yields limited confidentiality and integrity impact without affecting availability.
The referenced WPScan advisory at https://wpscan.com/vulnerability/6d09a5d3-046d-47ef-86b4-c024ea09dc0f provides further technical detail on the issue. The associated EPSS score has remained flat at 0.1602 with no material rise after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-44562
Vulnerability details
The Blog2Social WordPress plugin before 7.2.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.