CVE-2023-0429

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

The Watu Quiz WordPress plugin before 3.3.8.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Affected software

No affected versions have been published.

Timeline

Published: Feb 21, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-04306.5Certificate OCSP revocation status was not checked when verifying S/Mime signatures. Mail signed with a revoked certificate would be display CVE-2023-04315.4The File Away WordPress plugin through 3.9.9.0.1 does not validate and escape one of its shortcode attributes, which could allow users with CVE-2023-04329.0The web configuration service of the affected device contains an authenticated command injection vulnerability. It can be used to execute sy CVE-2023-04337.8Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1225.CVE-2023-04347.5Improper Input Validation in GitHub repository pyload/pyload prior to 0.5.0b3.dev40.CVE-2023-04359.8Excessive Attack Surface in GitHub repository pyload/pyload prior to 0.5.0b3.dev41.CVE-2023-04367.5The affected versions of MongoDB Atlas Kubernetes Operator may print sensitive information like GCP service account keys and API integration CVE-2023-04377.5When calling bson_utf8_validate on some inputs a loop with an exit condition that cannot be reached may occur, i.e. an infinite loop. This i CVE-2023-04386.5Cross-Site Request Forgery (CSRF) in GitHub repository modoboa/modoboa prior to 2.0.4.CVE-2023-04395.4The NEX-Forms WordPress plugin before 8.4.4 does not escape its form name, which could lead to Stored Cross-Site Scripting issues. By defaul CVE-2023-04405.3Observable Discrepancy in GitHub repository healthchecks/healthchecks prior to v2.6.CVE-2023-04418.1The Gallery Blocks with Lightbox WordPress plugin before 3.0.8 has an AJAX endpoint that can be accessed by any authenticated users, such as