CVE-2023-0230

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The VK All in One Expansion Unit WordPress plugin before 9.86.0.0 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Affected software

No affected versions have been published.

Timeline

Published
Feb 27, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-02315.4The ShopLentor WordPress plugin before 2.5.4 does not validate and escape some of its block options before outputting them back in a page/poCVE-2023-02329.8The ShopLentor WordPress plugin before 2.5.4 unserializes user input from cookies in order to track viewed products and user data, which couCVE-2023-02335.4The ActiveCampaign WordPress plugin before 8.1.12 does not validate and escape some of its block options before outputting them back in a paCVE-2023-02348.8The SiteGround Security WordPress plugin before 1.3.1 does not properly sanitize user input before using it in an SQL query, leading to an aCVE-2023-02366.1The Tutor LMS WordPress plugin before 2.0.10 does not sanitise and escape the reset_key and user_id parameters before outputting then back iCVE-2023-02385.5Due to lack of a security policy, the WARP Mobile Client (<=6.29) for Android was susceptible to this vulnerability which allowed a maliciouCVE-2023-02407.8There is a logic error in io_uring's implementation which can be used to trigger a use-after-free vulnerability leading to privilege escalatCVE-2023-02416.5pgAdmin 4 versions prior to v6.19 contains a directory traversal vulnerability. A user of the product may change another user's settings or CVE-2023-02428.8Rapid7 Velociraptor allows users to be created with different privileges on the server. Administrators are generally allowed to run any commCVE-2023-02439.8A vulnerability classified as critical has been found in TuziCMS 2.0.6. This affects the function index of the file App\Manage\Controller\ArCVE-2023-02449.8A vulnerability classified as critical was found in TuziCMS 2.0.6. This vulnerability affects the function delall of the file \App\Manage\CoCVE-2023-02459.8A vulnerability, which was classified as critical, has been found in SourceCodester Online Flight Booking Management System. This issue affe