CVE-2023-0424

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The MS-Reviews WordPress plugin through 1.5 does not sanitise and escape reviews, which could allow users any authenticated users, such as Subscribers to perform Stored Cross-Site Scripting attacks

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Affected software

No affected versions have been published.

Timeline

Published: Apr 24, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-04257.5ABB is aware of vulnerabilities in the product versions listed below. An update is available that resolves the reported vulnerabilities in t CVE-2023-04267.5ABB is aware of vulnerabilities in the product versions listed below. An update is available that resolves the reported vulnerabilities in t CVE-2023-04286.1The Watu Quiz WordPress plugin before 3.3.8.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a R CVE-2023-04294.8The Watu Quiz WordPress plugin before 3.3.8.2 does not sanitise and escape some of its settings, which could allow high privilege users such CVE-2023-04306.5Certificate OCSP revocation status was not checked when verifying S/Mime signatures. Mail signed with a revoked certificate would be display CVE-2023-04315.4The File Away WordPress plugin through 3.9.9.0.1 does not validate and escape one of its shortcode attributes, which could allow users with CVE-2023-04329.0The web configuration service of the affected device contains an authenticated command injection vulnerability. It can be used to execute sy CVE-2023-04337.8Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1225.CVE-2023-04347.5Improper Input Validation in GitHub repository pyload/pyload prior to 0.5.0b3.dev40.CVE-2023-04359.8Excessive Attack Surface in GitHub repository pyload/pyload prior to 0.5.0b3.dev41.CVE-2023-04367.5The affected versions of MongoDB Atlas Kubernetes Operator may print sensitive information like GCP service account keys and API integration CVE-2023-04377.5When calling bson_utf8_validate on some inputs a loop with an exit condition that cannot be reached may occur, i.e. an infinite loop. This i