CVE-2023-0418

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The Video Central for WordPress plugin through 1.3.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Affected software

No affected versions have been published.

Timeline

Published: Apr 24, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-04195.4The Shortcode for Font Awesome WordPress plugin before 1.4.1 does not validate and escape some of its shortcode attributes before outputting CVE-2023-04204.8The Custom Post Type and Taxonomy GUI Manager WordPress plugin through 1.1 does not have CSRF, and is lacking sanitising as well as escaping CVE-2023-04216.1The Cloud Manager WordPress plugin through 1.0 does not sanitise and escape the query param ricerca before outputting it in an admin panel, CVE-2023-04224.8The Article Directory WordPress plugin through 1.3 does not properly sanitize the `publish_terms_text` setting before displaying it in the a CVE-2023-04234.8The WordPress Amazon S3 Plugin WordPress plugin before 1.6 does not sanitise and escape a parameter before outputting it back in the page, l CVE-2023-04245.4The MS-Reviews WordPress plugin through 1.5 does not sanitise and escape reviews, which could allow users any authenticated users, such as S CVE-2023-04257.5ABB is aware of vulnerabilities in the product versions listed below. An update is available that resolves the reported vulnerabilities in t CVE-2023-04267.5ABB is aware of vulnerabilities in the product versions listed below. An update is available that resolves the reported vulnerabilities in t CVE-2023-04286.1The Watu Quiz WordPress plugin before 3.3.8.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a R CVE-2023-04294.8The Watu Quiz WordPress plugin before 3.3.8.2 does not sanitise and escape some of its settings, which could allow high privilege users such CVE-2023-04306.5Certificate OCSP revocation status was not checked when verifying S/Mime signatures. Mail signed with a revoked certificate would be display CVE-2023-04315.4The File Away WordPress plugin through 3.9.9.0.1 does not validate and escape one of its shortcode attributes, which could allow users with