-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from improper handling of the 'wle' parameter in login URL construction. The diff shows a critical change where the function stopped using $_REQUEST['wle'] and instead used a stored wle_code value. This indicates the previous implementation was vulnerable to reflected XSS through crafted 'wle' parameters, as user input was directly embedded in URLs without proper output encoding or validation.
PHPPHP| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| auth0/wordpress | composer | <= 4.6.0 | 4.6.1 |