CVE-2023-0605

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

The Auto Rename Media On Upload WordPress plugin before 1.1.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Affected software

Vendor	Product	Versions
Unknown	Auto Rename Media On Upload	< 1.1.0

References

https://wpscan.com/vulnerability/57267c3c-d55e-4b37-a6d0-c5cd8569625cExploit, Third Party Advisory
https://wpscan.com/vulnerability/57267c3c-d55e-4b37-a6d0-c5cd8569625cExploit, Third Party Advisory

Timeline

Published: Apr 10, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-06066.1Cross-site Scripting (XSS) - Reflected in GitHub repository ampache/ampache prior to 5.5.7.CVE-2023-06074.8Cross-site Scripting (XSS) - Stored in GitHub repository projectsend/projectsend prior to r1606.CVE-2023-06085.4Cross-site Scripting (XSS) - DOM in GitHub repository microweber/microweber prior to 1.3.2.CVE-2023-06094.3Improper Authorization in GitHub repository wallabag/wallabag prior to 2.5.3.CVE-2023-06104.3Improper Authorization in GitHub repository wallabag/wallabag prior to 2.5.3.CVE-2023-06118.8A vulnerability, which was classified as critical, has been found in TRENDnet TEW-652BRP 3.04B01. This issue affects some unknown processing CVE-2023-06127.5A vulnerability, which was classified as critical, was found in TRENDnet TEW-811DRU 1.0.10.0. Affected is an unknown function of the file /w CVE-2023-06137.5A vulnerability has been found in TRENDnet TEW-811DRU 1.0.10.0 and classified as critical. Affected by this vulnerability is an unknown func CVE-2023-06146.5The fix in 4.6.16, 4.7.9, 4.8.4 and 4.9.7 for CVE-2018-10919 Confidential attribute disclosure vi LDAP filters was insufficient and an attac CVE-2023-06155.5A memory leak flaw and potential divide by zero and Integer overflow was found in the Linux kernel V4L2 and vivid test code functionality. T CVE-2023-06166.5If a MIME email combines OpenPGP and OpenPGP MIME data in a certain way Thunderbird repeatedly attempts to process and display the message, CVE-2023-06177.5A vulnerability was found in TRENDNet TEW-811DRU 1.0.10.0. It has been classified as critical. This affects an unknown part of the file /wir