CVE-2023-23820


WordPress ProfilePress Plugin <= 4.5.4 is vulnerable to Cross Site Scripting (XSS)

Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in ProfilePress Membership Team ProfilePress plugin <= 4.5.4 versions.


We have discovered 3,480 live websites that are affected by CVE-2023-23820.

Contact us to get more info



Affected Software

Product  ProfilePress
Category Wordpress Plugins
Vulnerable Versions
  • from 0 through 4.5.4
Total Vulnerable Versions95
Vulnerable Domains3,480 live websites (17.74% of ProfilePress install base)


Common Weakness Enumeration


CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')


Distribution by Website Rank

The diagram provides a graphic representation of the correlation between the occurrence of CVE-2023-23820 and the relative popularity of websites


Details

  • Published - May 3, 2023
  • Updated - May 3, 2023

Credits

  • Rafie Muhammad (Patchstack) (finder)





Countries

United States1,103 websites


Japan379 websites
Germany301 websites
France176 websites
GB152 websites
Italy144 websites
Spain112 websites
Poland103 websites
Brazil93 websites
Canada59 websites

TLDs

.com1,609 websites
.de186 websites
.org179 websites
.net115 websites
.it93 websites
.jp87 websites
.co.uk76 websites
.com.br75 websites
.pl73 websites
.fr64 websites

Vulnerable Versions

Vulnerable versions are highlighted in red


Geographical Distribution

The distribution of websites across the globe that are exposed to CVE-2023-23820 through included software libraries and plugins.



References


Websites affected by CVE-2023-23820

Top websites that are affected by CVE-2023-23820. Please click on the "Contact us" button above to get more information.
DomainCountryRankContacts
***.*****.com Switzerland***
***.**********.com United States*,***
*********.com Japan**,***
***.*****.com United States**,***
***.****************.com United States**,***
***.******.com United States**,***
************.com United States**,***
***************.net United States**,***
******.com Estonia**,***
*******.com United States**,***
See full domain list