{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-08-01T03:13:45.016","vulnerabilities":[{"cve":{"id":"CVE-2023-5561","sourceIdentifier":"contact@wpscan.com","published":"2023-10-16T20:15:18.073","lastModified":"2026-06-17T06:48:50.680","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"WordPress does not properly restrict which user fields are searchable via the REST API, allowing unauthenticated attackers to discern the email addresses of users who have published public posts on an affected website via an Oracle style attack"},{"lang":"es","value":"El complemento Popup Builder de WordPress hasta la versión 4.1.15 no sanitiza ni escapa a algunas de sus configuraciones, lo que podría permitir a usuarios con privilegios elevados, como el administrador, realizar ataques de Cross-Site Scripting almacenados incluso cuando la capacidad unfiltered_html no está permitida (por ejemplo, en una configuración multisitio)."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"WordPress","product":"WordPress","defaultStatus":"unaffected","versions":[{"version":"6.3.0","lessThan":"6.3.2","versionType":"semver","status":"affected"},{"version":"6.2.0","lessThan":"6.2.3","versionType":"semver","status":"affected"},{"version":"6.1.0","lessThan":"6.1.4","versionType":"semver","status":"affected"},{"version":"6.0.0","lessThan":"6.0.6","versionType":"semver","status":"affected"},{"version":"5.9.0","lessThan":"5.9.8","versionType":"semver","status":"affected"},{"version":"5.8.0","lessThan":"5.8.8","versionType":"semver","status":"affected"},{"version":"5.7.0","lessThan":"5.7.10","versionType":"semver","status":"affected"},{"version":"5.6.0","lessThan":"5.6.12","versionType":"semver","status":"affected"},{"version":"5.5.0","lessThan":"5.5.13","versionType":"semver","status":"affected"},{"version":"5.4.0","lessThan":"5.4.14","versionType":"semver","status":"affected"},{"version":"5.3.0","lessThan":"5.3.16","versionType":"semver","status":"affected"},{"version":"5.2.0","lessThan":"5.2.19","versionType":"semver","status":"affected"},{"version":"5.0.0","lessThan":"5.0.20","versionType":"semver","status":"affected"},{"version":"4.9.0","lessThan":"4.9.24","versionType":"semver","status":"affected"},{"version":"4.8.0","lessThan":"4.8.23","versionType":"semver","status":"affected"},{"version":"4.7.0","lessThan":"4.7.27","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-04-23T16:07:50.654852Z","id":"CVE-2023-5561","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"NVD-CWE-noinfo"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","versionStartIncluding":"4.7","versionEndExcluding":"4.7.27","matchCriteriaId":"E2F659EB-27E2-4149-883B-341A0DD80EB0"},{"vulnerable":true,"criteria":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","versionStartIncluding":"4.8","versionEndExcluding":"4.8.23","matchCriteriaId":"C14B71C7-DD47-4900-8F84-8F7A594E555B"},{"vulnerable":true,"criteria":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","versionStartIncluding":"4.9","versionEndExcluding":"4.9.24","matchCriteriaId":"2C274BA0-BBD2-45EC-82EC-CFE0BA0AED0F"},{"vulnerable":true,"criteria":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","versionStartIncluding":"5.0","versionEndExcluding":"5.0.20","matchCriteriaId":"A923BA69-D672-4133-82EF-AFDDA5DD12DA"},{"vulnerable":true,"criteria":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","versionStartIncluding":"5.1","versionEndExcluding":"5.1.17","matchCriteriaId":"8A6E55DF-A05B-4420-B63B-0D1BEFB180EA"},{"vulnerable":true,"criteria":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","versionStartIncluding":"5.2","versionEndExcluding":"5.2.19","matchCriteriaId":"DC188A6D-DBA2-48CA-B6E2-EBA859AE9FEF"},{"vulnerable":true,"criteria":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","versionStartIncluding":"5.3","versionEndExcluding":"5.3.16","matchCriteriaId":"68F28900-3DC1-45F3-9B62-3347F14ADAB0"},{"vulnerable":true,"criteria":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","versionStartIncluding":"5.4","versionEndExcluding":"5.4.14","matchCriteriaId":"F5470536-6271-4D35-AB38-55DAEEC87980"},{"vulnerable":true,"criteria":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","versionStartIncluding":"5.5","versionEndExcluding":"5.5.13","matchCriteriaId":"274301F3-C6E4-40DF-90D4-3F597F715150"},{"vulnerable":true,"criteria":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","versionStartIncluding":"5.6","versionEndExcluding":"5.6.12","matchCriteriaId":"BF1391A3-84EA-469F-AB2A-B6A6AB84703C"},{"vulnerable":true,"criteria":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","versionStartIncluding":"5.7","versionEndExcluding":"5.7.10","matchCriteriaId":"EDF17959-9854-47FE-87D2-1DEE39B9F460"},{"vulnerable":true,"criteria":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","versionStartIncluding":"5.8","versionEndExcluding":"5.8.8","matchCriteriaId":"CE3F0CA8-9EAD-456A-A79E-D02473FF6075"},{"vulnerable":true,"criteria":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","versionStartIncluding":"5.9","versionEndExcluding":"5.9.8","matchCriteriaId":"358A2584-34C0-4E5A-BA24-855FD2092E71"},{"vulnerable":true,"criteria":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","versionStartIncluding":"6.0","versionEndExcluding":"6.0.6","matchCriteriaId":"2C359F62-24DD-4684-9806-7FBB3F5C10FC"},{"vulnerable":true,"criteria":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","versionStartIncluding":"6.1","versionEndExcluding":"6.1.4","matchCriteriaId":"680CD6CE-8815-44F8-9689-4B2155041E19"},{"vulnerable":true,"criteria":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","versionStartIncluding":"6.2","versionEndExcluding":"6.2.3","matchCriteriaId":"C10ED637-5054-4830-BE95-6F2F1194CCD2"},{"vulnerable":true,"criteria":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","versionStartIncluding":"6.3","versionEndExcluding":"6.3.2","matchCriteriaId":"4ED48F8A-D2AC-45FE-9B5F-231A0666A897"}]}]}],"references":[{"url":"https://lists.debian.org/debian-lts-announce/2023/11/msg00014.html","source":"contact@wpscan.com"},{"url":"https://wpscan.com/blog/email-leak-oracle-vulnerability-addressed-in-wordpress-6-3-2/","source":"contact@wpscan.com","tags":["Exploit","Third Party Advisory"]},{"url":"https://wpscan.com/vulnerability/19380917-4c27-4095-abf1-eba6f913b441","source":"contact@wpscan.com","tags":["Third Party Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/11/msg00014.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://wpscan.com/blog/email-leak-oracle-vulnerability-addressed-in-wordpress-6-3-2/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"]},{"url":"https://wpscan.com/vulnerability/19380917-4c27-4095-abf1-eba6f913b441","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]}]}}]}