CVE-2023-0086

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

The JetWidgets for Elementor plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.12. This is due to missing nonce validation on the save() function. This makes it possible for unauthenticated attackers to to modify the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. This can be used to enable SVG uploads that could make Cross-Site Scripting possible.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published: Jan 5, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-00874.8The Swifty Page Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘spm_plugin_options_page_tree_max_width’ p CVE-2023-00888.8The Swifty Page Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.0.1. This is du CVE-2023-00898.8The webutils in Proofpoint Enterprise Protection (PPS/POD) contain a vulnerability that allows an authenticated user to execute remote code CVE-2023-00909.8The webservices in Proofpoint Enterprise Protection (PPS/POD) contain a vulnerability that allows for an anonymous user to execute remote co CVE-2023-00913.8A flaw was found in Keycloak, where it did not properly check client tokens for possible revocation in its client credential flow. This flaw CVE-2023-00924.9An authenticated user who has read access to the juju controller model, may construct a remote request to download an arbitrary file from th CVE-2023-00938.8Okta Advanced Server Access Client versions 1.13.1 through 1.65.0 are vulnerable to command injection due to the third party library webbrow CVE-2023-00945.4The UpQode Google Maps WordPress plugin through 1.0.5 does not validate and escape some of its shortcode attributes before outputting them b CVE-2023-00955.4The Page View Count WordPress plugin before 2.6.1 does not validate and escape some of its block options before outputting them back in a pa CVE-2023-00965.4The Happyforms WordPress plugin before 1.22.0 does not validate and escape some of its block options before outputting them back in a page/p CVE-2023-00975.4The Post Grid, Post Carousel, & List Category Posts WordPress plugin before 2.4.19 does not validate and escape some of its block options be CVE-2023-00988.8The Simple URLs WordPress plugin before 115 does not escape some parameters before using them in various SQL statements used by AJAX actions