CVE-2023-0094

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The UpQode Google Maps WordPress plugin through 1.0.5 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Jan 16, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-00955.4The Page View Count WordPress plugin before 2.6.1 does not validate and escape some of its block options before outputting them back in a pa CVE-2023-00965.4The Happyforms WordPress plugin before 1.22.0 does not validate and escape some of its block options before outputting them back in a page/p CVE-2023-00975.4The Post Grid, Post Carousel, & List Category Posts WordPress plugin before 2.4.19 does not validate and escape some of its block options be CVE-2023-00988.8The Simple URLs WordPress plugin before 115 does not escape some parameters before using them in various SQL statements used by AJAX actions CVE-2023-00996.1The Simple URLs WordPress plugin before 115 does not sanitise and escape some parameters before outputting them back in some pages, leading CVE-2023-01008.8In Eclipse BIRT, starting from version 2.6.2, the default configuration allowed to retrieve a report from the same host using an absolute HT CVE-2023-01018.8A privilege escalation vulnerability was identified in Nessus versions 8.10.1 through 8.15.8 and 10.0.0 through 10.4.1. An authenticated att CVE-2023-01029.1LS ELECTRIC XBC-DN32U with operating system version 01.80 is missing authentication for its deletion command. This could allow an attacker t CVE-2023-01037.5If an attacker were to access memory locations of LS ELECTRIC XBC-DN32U with operating system version 01.80 that are outside of the communic CVE-2023-01047.8The listed versions for Weintek EasyBuilder Pro are vulnerable to a ZipSlip attack caused by decompiling a malicious project file. This may CVE-2023-01056.5A flaw was found in Keycloak. This flaw allows impersonation and lockout due to the email trust not being handled correctly in Keycloak. An CVE-2023-01065.4Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0.