CVE-2023-0733

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The Newsletter Popup WordPress plugin through 1.2 does not sanitise and escape some of its settings, which could allow unauthenticated users to perform Stored Cross-Site Scripting attacks

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected software

No affected versions have been published.

Timeline

Published: May 30, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-07345.3Improper Authorization in GitHub repository wallabag/wallabag prior to 2.5.4.CVE-2023-07356.5Cross-Site Request Forgery (CSRF) in GitHub repository wallabag/wallabag prior to 2.5.4.CVE-2023-07365.4Cross-site Scripting (XSS) - Stored in GitHub repository wallabag/wallabag prior to 2.5.4.CVE-2023-07376.5wallabag version 2.5.2 contains a Cross-Site Request Forgery (CSRF) vulnerability that allows attackers to arbitrarily delete user accounts CVE-2023-07386.1OrangeScrum version 2.0.11 allows an external attacker to obtain arbitrary user accounts from the application. This is possible because the CVE-2023-07396.8Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in GitHub repository answerdev/answer prior to 1 CVE-2023-07409.0Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.4.CVE-2023-07419.0Cross-site Scripting (XSS) - DOM in GitHub repository answerdev/answer prior to 1.0.4.CVE-2023-07429.0Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.4.CVE-2023-07439.0Cross-site Scripting (XSS) - Generic in GitHub repository answerdev/answer prior to 1.0.4.CVE-2023-07449.8Improper Access Control in GitHub repository answerdev/answer prior to 1.0.4.CVE-2023-07459.8The High Availability functionality of Yugabyte Anywhere can be abused to write arbitrary files through the backup upload endpoint by using