Medium severity · published Jul 10, 2024
CVE-2023-6813
Login by Auth0 <= 4.6.0 - Reflected Cross-Site Scripting via wle
6.1
CVSS
0.4%
EPSS
No
On KEV
Description
The Login by Auth0 plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘wle’ parameter in all versions up to, and including, 4.6.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 30% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LB
Login by Auth0 · auth0
through 4.6.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-6813
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-6813
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3114611%40auth0&new=3114611%40auth0&sfp_email=&sfph_mail=
www.wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/0c4e0d48-fde1-45dd-8e06-4582cf677579?source=cve
More from Login by Auth0
9.8
CVE-2020-7947
An issue was discovered in the Login by Auth0 plugin before 4.0.0 for WordPress
8.8
CVE-2020-7948
An issue was discovered in the Login by Auth0 plugin before 4.0.0 for WordPress
6.1
CVE-2020-6753
The Login by Auth0 plugin before 4.0.0 for WordPress allows stored XSS on multiple pages, a different issue than CVE-2020-5392
6.1
CVE-2019-20173
The Auth0 wp-auth0 plugin 3.11.x before 3.11.3 for WordPress allows XSS via a wle parameter associated with wp-login.php