GCVE - cpe:2.3:a:georgestephanis:application

Approved changes feed: RSS · Atom

cpe:2.3:a:georgestephanis:application_passwords:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Georgestephanis (`918f9785-42d2-5ee4-a874-01894b0c3b4e`)
Product	Application Passwords (`f2463c9c-ce74-5039-9fcd-ad0e4f648c87`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from gcve-enriched-dumps CVE data

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2025-13308`	vulnerable	2026-06-08 07:04:31.984748	Application Passwords <= 0.1.3 - Reflected Cross-Site Scripting via reject_url MEDIUM (5.4) The Application Passwords plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'reject_url' parameter in all versions up to, and including, 0.1.3. This is due to insufficient input sanitization and output escaping on user supplied URLs, which allows javascript: URI schemes to be embedded in the reject_url parameter. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute when a user clicks the "No, I do not approve of this connection" button, granted they can successfully trick the victim into performing an action such as clicking on a link. Published: 2025-12-06T05:49:27.817Z Updated: 2026-04-08T16:54:57.094Z Open on db.gcve.eu Reference links https://www.wordfence.com/threat-intel/vulnerabilities/id/59fdfdf3-e9fe-44d2-82f4-7a612a51d376?source=cve https://plugins.trac.wordpress.org/browser/application-passwords/tags/0.1.3/auth-app.js#L61 https://plugins.trac.wordpress.org/browser/application-passwords/tags/0.1.3/class.application-passwords.php#L418 https://plugins.trac.wordpress.org/browser/application-passwords/tags/0.1.3/class.application-passwords.php#L432	Imported from gcve-enriched-dumps CVE data

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.