Login by Auth0 <= 4.6.0 - Reflected Cross-Site Scripting via wle
Priority LOW 27CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.
Summary
The Login by Auth0 plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘wle’ parameter in all versions up to, and including, 4.6.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00359 29th percentileScored 2026-11-07
Fix Fixed auth0/wordpress (Packagist): 4.6.1
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| auth0 | Login by Auth0 | up to 4.6.0 | — | No fix listed | CNA |
| — | auth0/wordpress (Packagist) | before 4.6.1 | 4.6.1 | Patch available | GHSA-x6p7-44rh-m3rr |
- Login by Auth0 Vendorauth0 Affected up to 4.6.0 Fixed in — No fix listed CNA
- auth0/wordpress (Packagist) Vendor— Affected before 4.6.1 Fixed in 4.6.1 Patch available GHSA-x6p7-44rh-m3rr
Remediation
- Fix · GHSA-x6p7-44rh-m3rr auth0/wordpress (Packagist) Fixed in 4.6.1 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2023-6813
- 2026-10-03 Alias added: GHSA-x6p7-44rh-m3rr
References
Other 4
- https://www.wordfence.com/threat-intel/vulnerabilities/id/0c4e0d48-fde1-45dd-8e06-4582cf677579?source=cve
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3114611%40auth0&new=3114611%40auth0&sfp_email=&sfph_mail=
- https://github.com/auth0/wordpress/security/advisories/GHSA-x6p7-44rh-m3rr
- https://github.com/auth0/wordpress
More auth0 vulnerabilities
- TI-2015-07615 Improper input validation in HackerOne jsonwebtoken node module CVSS 3.0CRITICAL 9.8
- TI-2025-29805 Brute Force Authentication Tags of CookieStore Sessions in Auth0-PHP SDK CVSS 3.1CRITICAL 9.1
- TI-2025-31089 Auth0-PHP SDK Deserialization of Untrusted Data vulnerability CVSS 4.0CRITICAL 9.3
- TI-2020-06427 An issue was discovered in the Login by Auth0 plugin before 4.0.0 for WordPress. CVSS 3.1CRITICAL 9.8
- TI-2018-05020 The Auth0 authentication service before 2017-10-15 allows privilege escalation because… CVSS 3.0CRITICAL 9.8
- TI-2019-05387 Auth0 Auth0-WCF-Service-JWT before 1.0.4 leaks the expected JWT signature in an error… CVSS 3.0CRITICAL 9.8
Sources
- CVE-2023-6813 · CVE Program
- CVE-2023-6813 · NVD
- FIRST EPSS
- GHSA-x6p7-44rh-m3rr · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences