Skip to content
Sign in
Not rated

CVE-2023-2272 The Tiempo.com WordPress plugin through 0.1.2 does not sanitise and escape the page parameter before outputting it…

Description

The Tiempo.com WordPress plugin through 0.1.2 does not sanitise and escape the page parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

Affected products and versions

Product Affected versions Fixed in
Tiempo.com 0.1 earliest → 0.1.2 No fix stated

Other CVEs of Tiempo.com

The 3 CVEs of Tiempo.com →
CVE-2023-0058 The Tiempo.com WordPress plugin through 0.1.2 does not have CSRF check when creating and editing its shortcode, and is… Not rated CVE-2023-2271 The Tiempo.com WordPress plugin through 0.1.2 does not have CSRF check when deleting its shortcode, which could allow… Not rated
Track this CVE