CVE-2023-33999: wordpress 1-click-close-store Cross-site Scripting

CVSS: 7.1v3.1HighDeferred

Published 11-06-2026Last modified 11-06-2026

Vulnerability summary

CVE-2023-33999 is a high (CVSS 7.1) Cross-site Scripting vulnerability in wordpress 1-click-close-store. EPSS estimates a 0.27% chance of exploitation in the next 30 days, higher than 18.4% of scored vulnerabilities. Fixed in 5.5.2, 3.0.6 and 7.0.6.

Overall risk

28/100

0100

Medium · default modelHow is this calculated?

CVSS score

7.1/10

010

High · v3.1 (CVE.org)

EPSS score

0.27%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Timeline

11-06-2026
PublishedVulnerability first disclosed.
11-06-2026
Last modifiedVulnerability information updated.

Description

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in WPVibes WP Mail Log allows DOM-Based XSS. This issue affects WP Mail Log: from n/a through 1.0.2.

CVSS metrics

3 scores · 3 sources · 1 version

v3.17.1

EPSS trend

Probability

0.27%

Chance of exploitation in the next 30 days

Percentile

18%

Versus all other CVEs

30-day change

0.00 pp

From 0.27% on 19-09-2026

19-09-202619-10-2026

EPSS score

0.27%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Affected systems

Wordpress200 products

1-click-close-store1.1.0
2mb-autocode≤ 1.2.5 (fixed in 1.2.6)
3d-viewer≤ 1.3.3 (fixed in 1.3.4)
404-to-301≤ 3.0.5 (fixed in 3.0.6)
5-stars-rating-funnel≤ 1.2.62 (fixed in 1.2.63)

a-staff≥ 1.2, ≤ 1.2.2
acf-blocks≥ 1.0.0, ≤ 2.6.9 (fixed in 2.6.10)
acf-for-woocommerce-product≥ 0.1, ≤ 1.8.1
acf-frontend-form-element≤ 3.7.11 (fixed in 3.8.0)
acf-vc-integrator≤ 1.3.0 (fixed in 1.3.1)
activity-log-mainwp≤ 1.7.1 (fixed in 2.0.0)
adblock-notify-by-bweb≥ 2.0.8, ≤ 2.4.0
add-expires-headers≥ 2.0, ≤ 2.7.3 (fixed in 2.8.0)
add-fields-to-checkout-page-woocommerce≥ 1.2.7, ≤ 1.2.9 (fixed in 1.3.0)
add-search-to-menu≥ 4.0, ≤ 5.5.1 (fixed in 5.5.2)
addon-elements-for-elementor-page-builder≤ 1.11.16 (fixed in 1.12)
addons-for-elementor≥ 2.0.1, ≤ 7.7.1 (fixed in 7.9.1)
addons-for-visual-composer≥ 2.2.1, ≤ 3.2 (fixed in 3.3)
adminify≥ 1.0.0, ≤ 3.1.3 (fixed in 3.1.5)
advance-menu-manager≥ 3.0.1, ≤ 3.0.5 (fixed in 3.0.6)
advanced-classifieds-and-directory-pro≤ 2.1.1 (fixed in 2.1.2)
advanced-database-replacer≥ 1.0.0, ≤ 1.1.0
advanced-form-integration≤ 1.69.0 (fixed in 1.69.1)
advanced-nocaptcha-recaptcha≤ 7.0.5 (fixed in 7.0.6)
advanced-page-visit-counter≥ 3.0, ≤ 7.1.0 (fixed in 7.1.1)
advanced-usps-shipping-method≥ 1.0.0, ≤ 1.0.1 (fixed in 1.0.2)
advanced-visual-elements≤ 1.0.6 (fixed in 1.0.7)
affieasy≥ 0.9.22, ≤ 1.0.6
affiliate-advantage1.0.0
age-verification-screen-for-woocommerce≥ 1.0.1, ≤ 1.0.2
agendapress≤ 1.0.7
ai-image-generator≥ 1.0.0, ≤ 1.0.3
airpress≥ 1.1.51, ≤ 1.1.62
ajax-add-to-cart-for-woocommerce≥ 1.0.0, ≤ 1.0.2
ajax-search-for-woocommerce≥ 1.1.7, ≤ 1.24.0 (fixed in 1.25.0)
all-in-one-video-gallery≥ 1.5.7, ≤ 3.3.0 (fixed in 3.4.3)
animate-everything≤ 1.3.2
animated-svg≤ 2.2.0
annasta-woocommerce-product-filters≥ 1.0.5, ≤ 1.6.3 (fixed in 1.6.5)
anycomment≤ 0.0.98 (fixed in 0.0.99)
appexperts≤ 1.4.0
artificial-intelligence-auto-content-generator≤ 2.3.0 (fixed in 3.0.0)
atlas-knowledge-base≥ 1.0.0, ≤ 6.0
attribute-stock-for-woocommerce≤ 1.2.1 (fixed in 1.3.0)
audio-text1.0.0
auto-advance-for-gravity-forms≤ 4.5.3 (fixed in 4.5.4)
auto-date-year-month≥ 1.0.1, ≤ 1.1.2
auto-featured-image-auto-generated≥ 1.3.7, ≤ 1.5.4 (fixed in 1.6.0)
auto-keyword-backlink≥ 1.0, ≤ 1.3
auto-terms-of-service-and-privacy-policy≤ 1.8.2 (fixed in 2.0.0)
autocomplete-address-and-location-picker-for-woocommerce≥ 1.0.0, ≤ 1.1.5 (fixed in 1.1.7)
automail≤ 1.0.1
automatic-youtube-gallery≤ 2.3.2 (fixed in 2.3.3)
automizy-gravity-forms≥ 1.0.1, ≤ 1.3.0
autosave-net≥ 1.3.0, ≤ 1.3.4
avectra-netforum-single-sign-on≤ 1.3.4
awesome-social-icons2.0
azw-woocommerce-file-uploads≥ 1.0, ≤ 1.0.1
backup-bolt≥ 1.1.0, ≤ 1.1.3 (fixed in 1.2.0)
bdthemes-prime-slider-lite≤ 3.8.2 (fixed in 3.8.3)
before-and-after-product-images-for-woocommerce≥ 1.0.2, ≤ 1.0.3
better-captcha-gravity-forms≤ 0.5.2
block-options≤ 1.16 (fixed in 1.17)
block-styler-for-gravity-forms≥ 5.0.0, ≤ 6.2.1 (fixed in 6.3.0)
blockington1.0.2
blockmeister≥ 3.0.0, ≤ 3.1.9 (fixed in 3.1.10)
blockons≥ 1.0.2, ≤ 1.0.7 (fixed in 1.0.8)
blocks-bakery≥ 1.0.0, ≤ 1.0.12
blocks-product-editor-for-woocommerce≥ 1.0.0, ≤ 1.0.1 (fixed in 1.0.2)
blockspare≤ 2.6.4 (fixed in 2.6.5)
blog-designer-pack≤ 3.4 (fixed in 3.4.1)
blog-sidebar-widget≤ 1.0.5 (fixed in 1.0.6)
bnfw≤ 1.6.14 (fixed in 1.7)
bng-gateway-for-woocommerce≤ 1.6.10
book-buyback-prices≥ 1.0.2, ≤ 1.0.9
book-press≤ 1.2.4
booking-for-woocommerce≥ 1.0.0, ≤ 4.3.1
booking-weir≥ 1.0.0, ≤ 1.0.11
bookit≤ 2.3.9 (fixed in 2.4.0)
bp-better-messages≥ 1.9.10.72, ≤ 2.1.17 (fixed in 2.1.18)
bp-toolkit≤ 3.6.0 (fixed in 3.6.1)
buddydrive≤ 2.1.1 (fixed in 2.1.2)
buddyforms≤ 2.8.2 (fixed in 2.8.3)
buddyforms-acf≤ 1.3.4 (fixed in 1.3.5)
buddyforms-anonymous-author≤ 1.0 (fixed in 1.1)
buddyforms-attach-posts-to-groups-extension≤ 1.2.2 (fixed in 1.2.3)
buddyforms-easypin1.0.1
buddyforms-hierarchical-posts≤ 1.1.3 (fixed in 1.1.4)
buddyforms-members≤ 1.4.10 (fixed in 1.4.12)
buddyforms-remote≤ 1.0.4 (fixed in 1.0.5)
buddyforms-ultimate-member≤ 1.3.7 (fixed in 1.3.8)
buffer-my-post≤ 2020.1.0
bulk-attachment-download≥ 1.2.1, ≤ 1.3.6 (fixed in 1.3.7)
bulk-edit-categories-tags≥ 1.0.0, ≤ 1.7.4 (fixed in 1.7.5)
bulk-edit-events≥ 1.0.0, ≤ 1.1.20 (fixed in 1.1.21)
bulk-edit-user-profiles-in-spreadsheet≥ 1.0.1, ≤ 1.5.23 (fixed in 1.5.25)
bulk-woocommerce-category-creator≤ 2.3
bulletin-announcements≥ 1.0.1, ≤ 3.7.1 (fixed in 3.8.0)
business-profile-reviews≥ 1.0, ≤ 1.0.2
carousels-slider-for-divi≥ 1.5.0, ≤ 1.6.1
cart-weight-for-woocommerce≥ 1.0.0, ≤ 1.0.7
caxton≤ 1.30.0 (fixed in 1.30.1)
cf7-constant-contact-fields-mapping1.0.0
cf7-customizer≥ 1.1.0, ≤ 1.6.1
cf7-grid-and-styler-for-divi≥ 1.0.2, ≤ 1.4.2 (fixed in 1.5.2)
cf7-message-filter≤ 1.4.2 (fixed in 1.4.3)
cf7-styler≤ 1.5.3 (fixed in 1.5.4)
cf7-styler-for-divi≤ 1.3.2 (fixed in 1.3.3)
change-prices-with-time-for-woocommerce≤ 1.9.1
change-wc-price-title≤ 2.5 (fixed in 2.6)
chatpressai≤ 1.0.0
check-zipcode≥ 1.0.0, ≤ 1.0.1
checkbox≤ 0.8.3 (fixed in 0.8.5)
cheetaho-image-optimizer≤ 1.4.3 (fixed in 1.4.3.1)
child-support-calculator≥ 1.0.1, ≤ 2.0.1.2
choice-payment-gateway-for-woocommerce≥ 1.0.3, ≤ 2.2.2
cleanup-action-scheduler≥ 1.0.0, ≤ 1.1.0 (fixed in 1.2.0)
code-manager≥ 1.0.0, ≤ 1.0.25 (fixed in 1.0.26)
codepile≥ 1.0.0, ≤ 1.0.6
coinbase-commerce-for-contact-form-71.1.1 (fixed in 1.1.2)
collage-for-divi1.0.1
comments-not-replied-to≥ 1.5.0, ≤ 1.5.7 (fixed in 1.5.8)
commerce-coinbase-for-woocommerce≤ 1.4.14 (fixed in 1.5.0)
compare-affiliated-products≥ 2.0.1, ≤ 2.2.0
conditional-logic-for-woo-product-add-ons≥ 1.0.0, ≤ 1.2.0 (fixed in 1.2.1)
conditional-payments≥ 1.1.0, ≤ 1.1.2 (fixed in 1.1.3)
coneblog-widgets≥ 1.4.3, ≤ 1.4.6
connected-sermons≤ 1.2.1
contact-form-7-designer≥ 2.0, ≤ 2.2
contact-form-7-skins≤ 2.1 (fixed in 2.1.1)
contact-form-db-divi≥ 1.0, ≤ 1.0.1 (fixed in 1.2)
contact-list≥ 2.9.24, ≤ 2.9.69 (fixed in 2.9.72)
content-aware-sidebars≤ 3.19 (fixed in 3.19.1)
content-hubs≥ 1.0.6, ≤ 1.0.8
content-protector≤ 4.2.1 (fixed in 4.2.2)
content-restrictor-for-divi≥ 1.0.1, ≤ 1.4.2 (fixed in 1.4.3)
convert-classic-editor-to-blocks≥ 1.0.2, ≤ 1.0.6
convoworks-wp≤ 0.22.14 (fixed in 0.22.15)
cooked≤ 1.1.12 (fixed in 1.1.13)
copy-the-code≥ 1.3.0, ≤ 2.6.3 (fixed in 2.6.4)
cost-calculator-builder≤ 2.3.2 (fixed in 2.3.3)
cozy-addons≤ 1.2.3 (fixed in 1.2.4)
cpa-offerwall≥ 1.0.1, ≤ 1.0.2
cryptocurrency-product-for-woocommerce≤ 3.16.9 (fixed in 3.16.10)
current-template-name≤ 1.1.9 (fixed in 1.1.10)
custom-page-templates-by-vegacorp≥ 1.0.0, ≤ 1.1.13 (fixed in 1.1.14)
custom-product-builder-for-woocommerce≥ 1.0.1, ≤ 1.0.4 (fixed in 1.0.5)
custom-product-type-for-woocommerce≥ 1.0.0, ≤ 1.2.2 (fixed in 1.2.3)
custom-user-guide≤ 1.0.1
custom-welcome-guide≤ 1.0.8 (fixed in 1.0.9)
customer-chat-facebook≥ 1.1.0, ≤ 1.1.1
customizely≥ 1.0.1, ≤ 1.1.1
dancepress-trwa≥ 1.181106, ≤ 2.4.5 (fixed in 2.4.6.2)
dashylite≥ 2.0.1, ≤ 2.1.8
date-time-picker-field≥ 1.9, ≤ 2.2
delete-duplicate-posts≥ 4.1.9, ≤ 4.8.8 (fixed in 4.8.9)
delete-old-posts-programmatically≤ 3.4.2 (fixed in 3.4.3)
delicious-recipes≤ 1.5.2 (fixed in 1.5.3)
delivery-and-pickup-scheduling-for-woocommerce≤ 1.0.10 (fixed in 1.0.12)
delivery-drivers-for-vendors≥ 1.0.1, ≤ 1.1.0 (fixed in 1.1.1)
delivery-drivers-manager≥ 1.0.3, ≤ 1.1.8 (fixed in 1.1.9)
delivery-woo≥ 1.0, ≤ 1.0.4
demomentsomtres-categories2.5.5
demomentsomtres-mailchimp-immediate-send≥ 2.9, ≤ 3.201704251244
demomentsomtres-mailchimp-subscribe≥ 2.0, ≤ 3.201706150908
demomentsomtres-wp-export≤ 2.5 (fixed in 20200610)
device-wrapper1.1 (fixed in 1.1.2)
devices1.0.0
different-home-for-logged-in-logged-out≥ 1.1.0, ≤ 1.3.3 (fixed in 1.3.4)
disable-dashboard-for-woocommerce≥ 3.0.0, ≤ 3.2.8 (fixed in 3.2.9)
display-admin-page-on-frontend≥ 1.0.0, ≤ 1.20.0 (fixed in 1.21.1)
doko-box-builder≤ 1.0 (fixed in 1.0.1)
domain-mapping-system≤ 1.9.2 (fixed in 1.9.3)
download-magnet≥ 1.1.0, ≤ 1.2.0 (fixed in 1.2.2)
dracula-dark-mode1.0.0 (fixed in 1.0.1)
drop-shadow-boxes≥ 1.5.8, ≤ 1.7.10 (fixed in 1.7.12)
easy-call-now-button1.0.5
easy-facebook-likebox≥ 4.3.1, ≤ 6.4.9 (fixed in 6.5.0)
easy-marijuana-age-verify≤ 1.5.1 (fixed in 1.5.2)
easy-order-view1.0.0
easy-prayer≥ 1.0, ≤ 1.2
easy-schema-structured-data-rich-snippets≥ 2.0, ≤ 2.2.2
easy-settings-for-learndash≥ 1.1.0, ≤ 1.3.0
easy-tiktok-feed≥ 1.0.0, ≤ 1.1.1
easy-under-construction≥ 3.0, ≤ 6.0
easync-booking≥ 1.1.5, ≤ 1.3.6 (fixed in 1.3.7)
eazydocs≤ 2.2.0 (fixed in 2.2.1)
ecommerce-addon≥ 1.0, ≤ 1.3 (fixed in 1.4)
edd-tab-manager≤ 1.3.1
edge-gallery≥ 1.1, ≤ 2.0.4
education-addon≥ 1.0, ≤ 1.3.1
email-header-footer≥ 1.1, ≤ 1.2.1
email-tracker≤ 5.3.8 (fixed in 5.3.9)
emails-blacklist-everest-forms≤ 1.0.2 (fixed in 1.0.3)
embed-docs≥ 2.0.1, ≤ 3.0.0 (fixed in 3.0.1)
embed-office-viewer≤ 2.2.6 (fixed in 2.2.7)
embed-video-thumbnail≤ 1.3.0 (fixed in 1.3.1)
embedpress≤ 2.0.2 (fixed in 2.0.3)
enhanced-catalog-images-for-woocommerce1.0.1
enjoy-instagram-instagram-responsive-images-gallery-and-carousel≤ 6.2.0 (fixed in 6.2.1)

Show all 200

1 vendor · 200 products · Showing 200 of 759. Use Open JSON for the complete list.

References

2 links

patchstack.com/database/…VDB Entry
www.wordfence.com/threat-intel/vulnerabilities/id/5253fe2b-040b-417c-b257-0cb59ee5aa6eVendor Advisory

Vulnerability summary

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities