CVE-2023-0502

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

The WP News WordPress plugin through 1.1.9 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Affected software

No affected versions have been published.

Timeline

Published
Mar 27, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-05034.3The Free WooCommerce Theme 99fy Extension WordPress plugin before 1.2.8 does not have CSRF check when activating plugins, which could allow CVE-2023-05044.3The HT Politic WordPress plugin before 2.3.8 does not have CSRF check when activating plugins, which could allow attackers to make logged inCVE-2023-05054.3The Ever Compare WordPress plugin through 1.2.3 does not have CSRF check when activating plugins, which could allow attackers to make loggedCVE-2023-05068.8The web service of ByDemes Group Airspace CCTV Web Service in its 2.616.BY00.11 version, contains a privilege escalation vulnerability, deteCVE-2023-05075.4Grafana is an open-source platform for monitoring and observability. Starting with the 8.1 branch, Grafana had a stored XSS vulnerability CVE-2023-05084.3An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 before 15.10.8, all versions starting from 15.11 befoCVE-2023-05097.4Improper Certificate Validation in GitHub repository pyload/pyload prior to 0.5.0b3.dev44.CVE-2023-05119.8Relative Path Traversal vulnerability in ForgeRock Access Management Java Policy Agent allows Authentication Bypass. This issue affects AcceCVE-2023-05127.8Divide By Zero in GitHub repository vim/vim prior to 9.0.1247.CVE-2023-05135.4A vulnerability has been found in isoftforce Dreamer CMS up to 4.0.1 and classified as problematic. This vulnerability affects unknown code.CVE-2023-05146.1The Membership Database WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leadingCVE-2023-05157.2A vulnerability was found in SourceCodester Online Tours & Travels Management System 1.0 and classified as critical. This issue affects some