CVE-2023-0329

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

The Elementor Website Builder WordPress plugin before 3.12.2 does not properly sanitize and escape the Replace URL parameter in the Tools module before using it in a SQL statement, leading to a SQL injection exploitable by users with the Administrator role.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected software

No affected versions have been published.

Timeline

Published
May 30, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-03306.0A vulnerability in the lsi53c895a device affects the latest version of qemu. A DMA-MMIO reentrancy problem may lead to memory corruption bugCVE-2023-03317.5The Correos Oficial WordPress plugin through 1.2.0.2 does not have an authorization check user input validation when generating a file path,CVE-2023-03329.8A vulnerability was found in SourceCodester Online Food Ordering System 2.0. It has been classified as critical. Affected is an unknown funcCVE-2023-03335.4The TemplatesNext ToolKit WordPress plugin before 3.2.9 does not validate some of its shortcode attributes before using them to generate an CVE-2023-03346.1The ShortPixel Adaptive Images WordPress plugin before 3.6.3 does not sanitise and escape a parameter before outputting it back in the page,CVE-2023-03356.5The WP Shamsi WordPress plugin through 4.3.3 has CSRF and broken access control vulnerabilities which leads user with role as low as subscriCVE-2023-03366.5The OoohBoi Steroids for Elementor WordPress plugin before 2.1.5 has CSRF and broken access control vulnerabilities which leads user with roCVE-2023-03376.1Cross-site Scripting (XSS) - Reflected in GitHub repository lirantal/daloradius prior to master-branch.CVE-2023-03386.1Cross-site Scripting (XSS) - Reflected in GitHub repository lirantal/daloradius prior to master-branch.CVE-2023-03399.8Relative Path Traversal vulnerability in ForgeRock Access Management Web Policy Agent allows Authentication Bypass. This issue affects AccesCVE-2023-03408.8The Custom Content Shortcode WordPress plugin through 4.0.2 does not validate one of its shortcode attribute, which could allow users with aCVE-2023-03417.8A stack buffer overflow exists in the ec_glob function of editorconfig-core-c before v0.12.6 which allowed an attacker to arbitrarily write
CVE-2023-0329: High severity, CVSS 7.2 | Vulnix