CVE-2023-0389

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

The Calculated Fields Form WordPress plugin before 1.1.151 does not sanitise and escape some of its form settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Unknown	Calculated Fields Form	< 1.1.151

References

https://wpscan.com/vulnerability/090a3922-febc-4294-82d2-d8339d461893/Exploit, Third Party Advisory
https://wpscan.com/vulnerability/090a3922-febc-4294-82d2-d8339d461893/Exploit, Third Party Advisory

Timeline

Published: Jan 16, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-03918.1MGT-COMMERCE CloudPanel ships with a static SSL certificate to encrypt communications to the administrative interface, shared across every i CVE-2023-03926.7The LDAP Agent Update service with versions prior to 5.18 used an unquoted path, which could allow arbitrary code execution.CVE-2023-03945.5A NULL pointer dereference flaw was found in rawv6_push_pending_frames in net/ipv6/raw.c in the network subcomponent in the Linux kernel. Th CVE-2023-03955.4The menu shortcode WordPress plugin through 1.0 does not validate and escape some of its block options before outputting them back in a page CVE-2023-03966.8A malicious / defective bluetooth controller can cause buffer overreads in the most functions that process HCI command responses.CVE-2023-03976.5A malicious / defect bluetooth controller can cause a Denial of Service due to unchecked input in le_read_buffer_size_complete.CVE-2023-03986.5Cross-Site Request Forgery (CSRF) in GitHub repository modoboa/modoboa prior to 2.0.4.CVE-2023-03995.4The Image Over Image For WPBakery Page Builder WordPress plugin before 3.0 does not validate and escape some of its shortcode attributes bef CVE-2023-04008.2The protection bypass vulnerability in DLP for Windows 11.9.x is addressed in version 11.10.0. This allowed a local user to bypass DLP contr CVE-2023-04017.5A NULL pointer can be dereferenced when signatures are being verified on PKCS7 signed or signedAndEnveloped data. In case the hash algorithm CVE-2023-04025.4The Social Warfare plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on several AJAX actions in v CVE-2023-04035.4The Social Warfare plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.3.1. This is due to