CVE-2023-0766

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

The Newsletter Popup WordPress plugin through 1.2 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks as the wp_newsletter_show_localrecord page is not protected with a nonce.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected software

No affected versions have been published.

Timeline

Published
May 30, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-07678.8An attacker could construct a PKCS 12 cert bundle in such a way that could allow for arbitrary memory writes via PKCS 12 Safe Bag attributesCVE-2023-07688.8The Avirato hotels online booking engine WordPress plugin through 5.0.5 does not validate and escape some of its shortcode attributes beforeCVE-2023-07696.1The hiWeb Migration Simple WordPress plugin through 2.0.0.1 does not sanitise and escape a parameter before outputting it back in the page, CVE-2023-07707.8Stack-based Buffer Overflow in GitHub repository gpac/gpac prior to 2.2.CVE-2023-07718.8SQL Injection in GitHub repository ampache/ampache prior to 5.5.7,develop.CVE-2023-07726.5The Popup Builder by OptinMonster WordPress plugin before 2.12.2 does not ensure that the campaign to be loaded via some shortcodes is actuaCVE-2023-07739.8The vulnerability exists in Uniview IP Camera due to identification and authentication failure at its web-based management interface. A remoCVE-2023-07749.8A vulnerability has been found in SourceCodester Medical Certificate Generator App 1.0 and classified as critical. This vulnerability affectCVE-2023-07756.5An invalid ‘prepare write request’ command can cause the Bluetooth LE stack to run out of memory and fail to be able to handle subsequent coCVE-2023-077610.0Baicells Nova 436Q, Nova 430E, Nova 430I, and Neutrino 430 LTE TDD eNodeB devices with firmware through QRTB 2.12.7 are vulnerable to remoteCVE-2023-07779.8Authentication Bypass by Primary Weakness in GitHub repository modoboa/modoboa prior to 2.0.4.CVE-2023-07786.8A Time-of-check Time-of-use (TOCTOU) flaw was found in podman. This issue may allow a malicious user to replace a normal file in a volume wi