CVE-2023-0367

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The Pricing Tables For WPBakery Page Builder (formerly Visual Composer) WordPress plugin before 3.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Affected software

No affected versions have been published.

Timeline

Published
Apr 17, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-03685.4The Responsive Tabs For WPBakery Page Builder (formerly Visual Composer) WordPress plugin through 1.1 does not validate and escape some of iCVE-2023-03695.4The GoToWP WordPress plugin through 5.1.1 does not validate and escape some of its shortcode attributes before outputting them back in a pagCVE-2023-03705.4The WPB Advanced FAQ WordPress plugin through 1.0.6 does not validate and escape some of its shortcode attributes before outputting them bacCVE-2023-03715.4The EmbedSocial WordPress plugin before 1.1.28 does not validate and escape some of its shortcode attributes before outputting them back in CVE-2023-03725.4The EmbedStories WordPress plugin before 0.7.5 does not validate and escape some of its shortcode attributes before outputting them back in CVE-2023-03735.4The Lightweight Accordion WordPress plugin before 1.5.15 does not validate and escape some of its block options before outputting them back CVE-2023-03745.4The W4 Post List WordPress plugin before 2.4.6 does not validate and escape some of its block options before outputting them back in a page/CVE-2023-03755.4The Easy Affiliate Links WordPress plugin before 3.7.1 does not validate and escape some of its block options before outputting them back inCVE-2023-03765.4The Qubely WordPress plugin before 1.8.5 does not validate and escape some of its block options before outputting them back in a page/post wCVE-2023-03775.4The Scriptless Social Sharing WordPress plugin before 3.2.2 does not validate and escape some of its block options before outputting them baCVE-2023-03785.4The Greenshift WordPress plugin before 5.0 does not validate and escape some of its block options before outputting them back in a page/postCVE-2023-03795.4The Spotlight Social Feeds WordPress plugin before 1.4.3 does not validate and escape some of its block options before outputting them back
CVE-2023-0367: Medium severity, CVSS 5.4 | Vulnix