CVE-2023-0603

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

The Sloth Logo Customizer WordPress plugin through 2.0.2 does not have CSRF check when updating its settings, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
Unknown	Sloth Logo Customizer	<= 2.0.2

References

Timeline

Published: May 8, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-06045.4The WP Food Manager WordPress plugin before 1.0.4 does not sanitise and escape some of its settings, which could allow high privilege users CVE-2023-06054.8The Auto Rename Media On Upload WordPress plugin before 1.1.0 does not sanitise and escape some of its settings, which could allow high priv CVE-2023-06066.1Cross-site Scripting (XSS) - Reflected in GitHub repository ampache/ampache prior to 5.5.7.CVE-2023-06074.8Cross-site Scripting (XSS) - Stored in GitHub repository projectsend/projectsend prior to r1606.CVE-2023-06085.4Cross-site Scripting (XSS) - DOM in GitHub repository microweber/microweber prior to 1.3.2.CVE-2023-06094.3Improper Authorization in GitHub repository wallabag/wallabag prior to 2.5.3.CVE-2023-06104.3Improper Authorization in GitHub repository wallabag/wallabag prior to 2.5.3.CVE-2023-06118.8A vulnerability, which was classified as critical, has been found in TRENDnet TEW-652BRP 3.04B01. This issue affects some unknown processing CVE-2023-06127.5A vulnerability, which was classified as critical, was found in TRENDnet TEW-811DRU 1.0.10.0. Affected is an unknown function of the file /w CVE-2023-06137.5A vulnerability has been found in TRENDnet TEW-811DRU 1.0.10.0 and classified as critical. Affected by this vulnerability is an unknown func CVE-2023-06146.5The fix in 4.6.16, 4.7.9, 4.8.4 and 4.9.7 for CVE-2018-10919 Confidential attribute disclosure vi LDAP filters was insufficient and an attac CVE-2023-06155.5A memory leak flaw and potential divide by zero and Integer overflow was found in the Linux kernel V4L2 and vivid test code functionality. T