CVE-2023-0731

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The Interactive Geo Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the action content parameter in versions up to, and including, 1.5.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with editor level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Feb 7, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-07326.1A vulnerability has been found in SourceCodester Online Eyewear Shop 1.0 and classified as problematic. Affected by this vulnerability is th CVE-2023-07336.1The Newsletter Popup WordPress plugin through 1.2 does not sanitise and escape some of its settings, which could allow unauthenticated users CVE-2023-07345.3Improper Authorization in GitHub repository wallabag/wallabag prior to 2.5.4.CVE-2023-07356.5Cross-Site Request Forgery (CSRF) in GitHub repository wallabag/wallabag prior to 2.5.4.CVE-2023-07365.4Cross-site Scripting (XSS) - Stored in GitHub repository wallabag/wallabag prior to 2.5.4.CVE-2023-07376.5wallabag version 2.5.2 contains a Cross-Site Request Forgery (CSRF) vulnerability that allows attackers to arbitrarily delete user accounts CVE-2023-07386.1OrangeScrum version 2.0.11 allows an external attacker to obtain arbitrary user accounts from the application. This is possible because the CVE-2023-07396.8Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in GitHub repository answerdev/answer prior to 1 CVE-2023-07409.0Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.4.CVE-2023-07419.0Cross-site Scripting (XSS) - DOM in GitHub repository answerdev/answer prior to 1.0.4.CVE-2023-07429.0Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.4.CVE-2023-07439.0Cross-site Scripting (XSS) - Generic in GitHub repository answerdev/answer prior to 1.0.4.