CVE-2023-0294

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

The Mediamatic – Media Library Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.8.1. This is due to missing or incorrect nonce validation on its AJAX actions function. This makes it possible for unauthenticated attackers to change image categories used by the plugin, via forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
plugincraft	Mediamatic – Media Library Folders	<= 2.8.1

References

Timeline

Published: Jan 13, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-02954.8The Launchpad plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several of its settings parameters in versions up to, an CVE-2023-02965.3The Birthday attack against 64-bit block ciphers flaw (CVE-2016-2183) was reported for the health checks port (9979) on etcd grpc-proxy comp CVE-2023-02979.8Code Injection in GitHub repository pyload/pyload prior to 0.5.0b3.dev31.CVE-2023-02986.5Incorrect Authorization in GitHub repository firefly-iii/firefly-iii prior to 5.8.0.CVE-2023-02999.8Improper Input Validation in GitHub repository publify/publify prior to 9.2.10.CVE-2023-03005.4Cross-site Scripting (XSS) - Reflected in GitHub repository alfio-event/alf.io prior to 2.0-M4-2301.CVE-2023-03015.4Cross-site Scripting (XSS) - Stored in GitHub repository alfio-event/alf.io prior to Alf.io 2.0-M4-2301.CVE-2023-03027.8Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in GitHub repository radareorg/radare2 prior to 5.8.CVE-2023-03037.5A vulnerability was found in SourceCodester Online Food Ordering System. It has been rated as critical. Affected by this issue is some unkno CVE-2023-03047.5A vulnerability classified as critical has been found in SourceCodester Online Food Ordering System. This affects an unknown part of the fil CVE-2023-03057.5A vulnerability classified as critical was found in SourceCodester Online Food Ordering System. This vulnerability affects unknown code of t CVE-2023-03065.4Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.10.