CVE:CVE-2023-2362
CNNVD:CNNVD-202306-808
WordPress和WordPress plugin都是WordPress基金会的产品。WordPress是一套使用PHP语言开发的博客平台。该平台支持在PHP和MySQL的服务器上架设个人博客网站。WordPress plugin是一个应用插件。
WordPress Plugin Float menu 5.0.2 之前版本，Bubble Menu 3.0.4 之前版本，Button Generator 2.3.5 之前版本，Calculator Builder 1.5.1 之前版本，Counter Box 1.2.2 之前版本，Floating Button 5.3.1 之前版本，Herd Effects WordPress 5.2.2 之前版本，Popup Box WordPress 2.2.2 之前版本，Side Menu Lite WordPress 4.0.2 之前版本，Sticky Buttons WordPress 3.1.1 之前版本，Wow Skype Buttons WordPress 4.0 之前版本，WP Coder 2.5.6 之前版本存在跨站脚本漏洞，该漏洞源于插件不会对页面参数进行转义，攻击者利用该漏洞可以将恶意脚本注入web网站。
solution:Upgrade wow-company bubble_menu to a higher version than 3.0.4,and avoid the version (,3.0.4); Upgrade wow-company button_generator to a higher version than 2.3.5,and avoid the version (,2.3.5); Upgrade wow-company calculator-builder to a higher version than 1.5.1,and avoid the version (,1.5.1); Upgrade wow-company counter_box to a higher version than 1.2.2,and avoid the version (,1.2.2); Upgrade wow-company float_menu to a higher version than 5.0.2,and avoid the version (,5.0.2); Upgrade wow-company floating_button to a higher version than 5.3.1,and avoid the version (,5.3.1); Upgrade wow-company herd_effects to a higher version than 5.2.2,and avoid the version (,5.2.2); Upgrade wow-company popup_box to a higher version than 2.2.2,and avoid the version (,2.2.2); Upgrade wow-company side_menu_lite to a higher version than 4.0.2,and avoid the version (,4.0.2); Upgrade wow-company sticky_buttons to a higher version than 3.1.1,and avoid the version (,3.1.1); Upgrade wow-company wow_skype_buttons to a higher version than 4.0.2,and avoid the version (,4.0.2); Upgrade wow-company wp_coder to a higher version than 2.5.6,and avoid the version (,2.5.6)