CVE-2023-0422

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

The Article Directory WordPress plugin through 1.3 does not properly sanitize the `publish_terms_text` setting before displaying it in the administration panel, which may enable administrators to conduct Stored XSS attacks in multisite contexts.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Affected software

Vendor	Product	Versions
Unknown	Article Directory	<= 1.3

References

https://wpscan.com/vulnerability/d57f2fb2-5251-4069-8c9a-a4af269c5e62Exploit, Third Party Advisory
https://wpscan.com/vulnerability/d57f2fb2-5251-4069-8c9a-a4af269c5e62Exploit, Third Party Advisory

Timeline

Published: Apr 10, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-04234.8The WordPress Amazon S3 Plugin WordPress plugin before 1.6 does not sanitise and escape a parameter before outputting it back in the page, l CVE-2023-04245.4The MS-Reviews WordPress plugin through 1.5 does not sanitise and escape reviews, which could allow users any authenticated users, such as S CVE-2023-04257.5ABB is aware of vulnerabilities in the product versions listed below. An update is available that resolves the reported vulnerabilities in t CVE-2023-04267.5ABB is aware of vulnerabilities in the product versions listed below. An update is available that resolves the reported vulnerabilities in t CVE-2023-04286.1The Watu Quiz WordPress plugin before 3.3.8.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a R CVE-2023-04294.8The Watu Quiz WordPress plugin before 3.3.8.2 does not sanitise and escape some of its settings, which could allow high privilege users such CVE-2023-04306.5Certificate OCSP revocation status was not checked when verifying S/Mime signatures. Mail signed with a revoked certificate would be display CVE-2023-04315.4The File Away WordPress plugin through 3.9.9.0.1 does not validate and escape one of its shortcode attributes, which could allow users with CVE-2023-04329.0The web configuration service of the affected device contains an authenticated command injection vulnerability. It can be used to execute sy CVE-2023-04337.8Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1225.CVE-2023-04347.5Improper Input Validation in GitHub repository pyload/pyload prior to 0.5.0b3.dev40.CVE-2023-04359.8Excessive Attack Surface in GitHub repository pyload/pyload prior to 0.5.0b3.dev41.