{"id":"CVE-2023-0285","state":"PUBLISHED","title":"Real Media Library < 4.18.29 - Author+ Stored XSS","description":"The Real Media Library WordPress plugin before 4.18.29 does not sanitise and escape the created folder names, which could allow users with the role of author and above to perform Stored Cross-Site Scripting attacks.","publishedAt":"2023-02-21T08:50:42.950Z","updatedAt":"2025-03-12T15:26:03.312Z","severity":null,"assigner":"WPScan","products":["Unknown Real Media Library: Media Library Folder & File Manager"],"affected":[{"vendor":"Unknown","product":"Real Media Library: Media Library Folder & File Manager","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"4.18.29","versionType":"custom"}],"collectionURL":"https://wordpress.org/plugins"}],"references":["https://wpscan.com/vulnerability/adf09e29-baf5-4426-a281-6763c107d348"],"weaknesses":["CWE-79"],"ingestedAt":"2026-10-29T20:05:36.141Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/0xxx/CVE-2023-0285.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2023-0285","state":"PUBLISHED","datePublished":"2023-02-21T08:50:42.950Z","dateUpdated":"2025-03-12T15:26:03.312Z","assignerShortName":"WPScan","assignerOrgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","dateReserved":"2023-01-13T10:17:26.382Z"},"containers":{"cna":{"title":"Real Media Library < 4.18.29 - Author+ Stored XSS","descriptions":[{"lang":"en","value":"The Real Media Library WordPress plugin before 4.18.29 does not sanitise and escape the created folder names, which could allow users with the role of author and above to perform Stored Cross-Site Scripting attacks."}],"affected":[{"vendor":"Unknown","product":"Real Media Library: Media Library Folder & File Manager","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"4.18.29","versionType":"custom"}],"collectionURL":"https://wordpress.org/plugins"}],"references":[{"url":"https://wpscan.com/vulnerability/adf09e29-baf5-4426-a281-6763c107d348","tags":["exploit","vdb-entry","technical-description"]}],"problemTypes":[{"descriptions":[{"description":"CWE-79 Cross-Site Scripting (XSS)","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"WPScan","orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","dateUpdated":"2023-02-21T08:50:42.950Z"},"credits":[{"lang":"en","value":"Bipul Jaiswal from SecureLayer7","type":"finder"},{"lang":"en","value":"WPScan","type":"coordinator"}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"WPScan CVE Generator"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://wpscan.com/vulnerability/adf09e29-baf5-4426-a281-6763c107d348","tags":["exploit","vdb-entry","technical-description","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T05:02:44.190Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-03-12T15:25:25.615328Z","id":"CVE-2023-0285","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-79","type":"CWE","lang":"en","description":"CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-03-12T15:26:03.312Z"}}]}}}