CVE-2023-0275

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The Easy Accept Payments for PayPal WordPress plugin before 4.9.10 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Affected software

No affected versions have been published.

Timeline

Published: Feb 13, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-02765.4The Weaver Xtreme Theme Support WordPress plugin before 6.2.7 does not validate and escape some of its shortcode attributes before outputtin CVE-2023-02777.2The WC Fields Factory WordPress plugin through 4.1.5 does not properly sanitise and escape a parameter before using it in a SQL statement, l CVE-2023-02787.2The GeoDirectory WordPress plugin before 2.2.24 does not properly sanitise and escape a parameter before using it in a SQL statement, leadin CVE-2023-02797.2The Media Library Assistant WordPress plugin before 3.06 does not properly sanitise and escape a parameter before using it in a SQL statemen CVE-2023-02805.4The Ultimate Carousel For Elementor WordPress plugin through 2.1.7 does not validate and escape some of its block options before outputting CVE-2023-02819.8A vulnerability was found in SourceCodester Online Flight Booking Management System. It has been rated as critical. Affected by this issue i CVE-2023-02825.4The YourChannel WordPress plugin before 1.2.2 does not sanitize and escape some parameters, which could allow users with a role as low as Su CVE-2023-02839.8A vulnerability classified as critical has been found in SourceCodester Online Flight Booking Management System. This affects an unknown par CVE-2023-02848.1Improper Input Validation of LDAP user IDs in Tribe29 Checkmk allows attackers that can control LDAP user IDs to manipulate files on the ser CVE-2023-02855.4The Real Media Library WordPress plugin before 4.18.29 does not sanitise and escape the created folder names, which could allow users with t CVE-2023-02867.4There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName. X.400 addresses were parsed as an CVE-2023-02875.4A vulnerability was found in ityouknow favorites-web. It has been rated as problematic. Affected by this issue is some unknown functionality