CVE-2023-6000
Published: 01 January 2024
Summary
CVE-2023-6000 is a medium-severity Cross-site Scripting (CWE-79) vulnerability in Sygnoos Popup Builder. Its CVSS base score is 6.1 (Medium).
Operationally, ranked in the top 1.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
The vulnerability CVE-2023-6000 is a stored cross-site scripting flaw (CWE-79) affecting the Popup Builder WordPress plugin before version 4.2.3. The root cause is missing authorization checks that allow any visitor to edit existing popups and inject raw JavaScript payloads into them, rated at CVSS 6.1 with network attack vector, low complexity, no required privileges, and required user interaction.
An unauthenticated attacker can exploit the issue remotely by submitting crafted updates to popup content. This results in persistent execution of attacker-controlled scripts in the browsers of subsequent visitors, enabling limited impacts on confidentiality and integrity within the affected site's context.
WPScan advisories state that the flaw is resolved in Popup Builder 4.2.3 through added access controls that block unauthorized popup modifications. The associated EPSS score remains at 0.6912 with no material change since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-58267
Vulnerability details
The Popup Builder WordPress plugin before 4.2.3 does not prevent simple visitors from updating existing popups, and injecting raw JavaScript in them, which could lead to Stored XSS attacks.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Penetration testing submits XSS payloads to web applications, detecting cross-site scripting flaws for subsequent remediation.
Validates web inputs to reject script-related content that could produce XSS.
Output validation against expected content can reject or sanitize script content in generated web pages, reducing XSS exploitability.