CVE-2023-0388

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

The Random Text WordPress plugin through 0.3.0 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by any authenticated users, such as subscribers.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
Unknown	Random Text	<= 0.3.0

References

https://wpscan.com/vulnerability/77861a2e-879a-4bd0-b4c0-cd19481ace5dExploit, Third Party Advisory
https://wpscan.com/vulnerability/77861a2e-879a-4bd0-b4c0-cd19481ace5dExploit, Third Party Advisory

Timeline

Published: Apr 24, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-03894.8The Calculated Fields Form WordPress plugin before 1.1.151 does not sanitise and escape some of its form settings, which could allow high pr CVE-2023-03918.1MGT-COMMERCE CloudPanel ships with a static SSL certificate to encrypt communications to the administrative interface, shared across every i CVE-2023-03926.7The LDAP Agent Update service with versions prior to 5.18 used an unquoted path, which could allow arbitrary code execution.CVE-2023-03945.5A NULL pointer dereference flaw was found in rawv6_push_pending_frames in net/ipv6/raw.c in the network subcomponent in the Linux kernel. Th CVE-2023-03955.4The menu shortcode WordPress plugin through 1.0 does not validate and escape some of its block options before outputting them back in a page CVE-2023-03966.8A malicious / defective bluetooth controller can cause buffer overreads in the most functions that process HCI command responses.CVE-2023-03976.5A malicious / defect bluetooth controller can cause a Denial of Service due to unchecked input in le_read_buffer_size_complete.CVE-2023-03986.5Cross-Site Request Forgery (CSRF) in GitHub repository modoboa/modoboa prior to 2.0.4.CVE-2023-03995.4The Image Over Image For WPBakery Page Builder WordPress plugin before 3.0 does not validate and escape some of its shortcode attributes bef CVE-2023-04008.2The protection bypass vulnerability in DLP for Windows 11.9.x is addressed in version 11.10.0. This allowed a local user to bypass DLP contr CVE-2023-04017.5A NULL pointer can be dereferenced when signatures are being verified on PKCS7 signed or signedAndEnveloped data. In case the hash algorithm CVE-2023-04025.4The Social Warfare plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on several AJAX actions in v