CVE-2023-0769

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The hiWeb Migration Simple WordPress plugin through 2.0.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high-privilege users such as admins.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Unknown	hiWeb Migration Simple	<= 2.0.0.1

References

https://wpscan.com/vulnerability/1d4a2f0e-a371-4e27-98de-528e070f41b0/Exploit, Third Party Advisory
https://wpscan.com/vulnerability/1d4a2f0e-a371-4e27-98de-528e070f41b0/Exploit, Third Party Advisory

Timeline

Published: Jan 16, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-07707.8Stack-based Buffer Overflow in GitHub repository gpac/gpac prior to 2.2.CVE-2023-07718.8SQL Injection in GitHub repository ampache/ampache prior to 5.5.7,develop.CVE-2023-07726.5The Popup Builder by OptinMonster WordPress plugin before 2.12.2 does not ensure that the campaign to be loaded via some shortcodes is actua CVE-2023-07739.8The vulnerability exists in Uniview IP Camera due to identification and authentication failure at its web-based management interface. A remo CVE-2023-07749.8A vulnerability has been found in SourceCodester Medical Certificate Generator App 1.0 and classified as critical. This vulnerability affect CVE-2023-07756.5An invalid ‘prepare write request’ command can cause the Bluetooth LE stack to run out of memory and fail to be able to handle subsequent co CVE-2023-077610.0Baicells Nova 436Q, Nova 430E, Nova 430I, and Neutrino 430 LTE TDD eNodeB devices with firmware through QRTB 2.12.7 are vulnerable to remote CVE-2023-07779.8Authentication Bypass by Primary Weakness in GitHub repository modoboa/modoboa prior to 2.0.4.CVE-2023-07786.8A Time-of-check Time-of-use (TOCTOU) flaw was found in podman. This issue may allow a malicious user to replace a normal file in a volume wi CVE-2023-07797.7At the most basic level, an invalid pointer can be input that crashes the device, but with more knowledge of the device’s memory layout, fur CVE-2023-07805.4Improper Restriction of Rendered UI Layers or Frames in GitHub repository cockpit-hq/cockpit prior to 2.3.9-dev.CVE-2023-07819.8A vulnerability was found in SourceCodester Canteen Management System 1.0. It has been declared as critical. This vulnerability affects the