CVE-2023-0255

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

The Enable Media Replace WordPress plugin before 4.0.2 does not prevent authors from uploading arbitrary files to the site, which may allow them to upload PHP shells on affected sites.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

Vendor	Product	Versions
Unknown	Enable Media Replace	< 4.0.2

References

https://wpscan.com/vulnerability/b0239208-1e23-4774-9b8c-9611704a07a0Exploit, Third Party Advisory
https://wpscan.com/vulnerability/b0239208-1e23-4774-9b8c-9611704a07a0Exploit, Third Party Advisory

Timeline

Published: Feb 13, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-02569.8A vulnerability was found in SourceCodester Online Food Ordering System 2.0. It has been classified as critical. Affected is an unknown func CVE-2023-02579.8A vulnerability was found in SourceCodester Online Food Ordering System 2.0. It has been declared as critical. Affected by this vulnerabilit CVE-2023-02586.1A vulnerability was found in SourceCodester Online Food Ordering System 2.0. It has been rated as problematic. Affected by this issue is som CVE-2023-02598.8The WP Google Review Slider WordPress plugin before 11.8 does not properly sanitise and escape a parameter before using it in a SQL statemen CVE-2023-02608.8The WP Review Slider WordPress plugin before 12.2 does not properly sanitise and escape a parameter before using it in a SQL statement, lead CVE-2023-02618.8The WP TripAdvisor Review Slider WordPress plugin before 10.8 does not properly sanitise and escape a parameter before using it in a SQL sta CVE-2023-02628.8The WP Airbnb Review Slider WordPress plugin before 3.3 does not properly sanitise and escape a parameter before using it in a SQL statement CVE-2023-02638.8The WP Yelp Review Slider WordPress plugin before 7.1 does not properly sanitise and escape a parameter before using it in a SQL statement, CVE-2023-02645.0A flaw was found in Keycloaks OpenID Connect user authentication, which may incorrectly authenticate requests. An authenticated attacker who CVE-2023-02658.8Uvdesk version 1.1.1 allows an authenticated remote attacker to execute commands on the server. This is possible because the application doe CVE-2023-02667.0A use after free vulnerability exists in the ALSA PCM package in the Linux Kernel. SNDRV_CTL_IOCTL_ELEM_{READ|WRITE}32 is missing locks that CVE-2023-02675.4The Ultimate Carousel For WPBakery Page Builder WordPress plugin through 2.6 does not validate and escape some of its shortcode attributes b