CVE-2023-0895

MediumCVSS 4.9/10Last modified Jun 17, 2026

Description

The WP Coder – add custom html, css and js code plugin for WordPress is vulnerable to time-based SQL Injection via the ‘id’ parameter in versions up to, and including, 2.5.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with administrative privileges to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Metrics

CVSS 3.1 4.9/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published: Feb 17, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-08968.8A default password was reported in Lenovo Smart Clock Essential with Alexa Built In that could allow unauthorized device access to an attack CVE-2023-08979.8Sielco PolyEco1000 is vulnerable to a session hijack vulnerability due to the cookie being vulnerable to a brute force attack, lack of SSL, CVE-2023-08987.3General Electric MiCOM S1 Agile is vulnerable to an attacker achieving code execution by placing malicious DLL files in the directory of the CVE-2023-08996.1The Steveas WP Live Chat Shoutbox WordPress plugin through 1.4.2 does not sanitise and escape a parameter before outputting it back in the S CVE-2023-09007.2The Pricing Table Builder WordPress plugin through 1.1.6 does not properly sanitise and escape a parameter before using it in a SQL statemen CVE-2023-09015.3Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository pixelfed/pixelfed prior to 0.11.4.CVE-2023-09025.4A vulnerability was found in SourceCodester Simple Food Ordering System 1.0. It has been classified as problematic. This affects an unknown CVE-2023-09038.8A vulnerability was found in SourceCodester Employee Task Management System 1.0. It has been declared as critical. This vulnerability affect CVE-2023-09048.8A vulnerability was found in SourceCodester Employee Task Management System 1.0. It has been rated as critical. This issue affects some unkn CVE-2023-09057.5A vulnerability classified as critical has been found in SourceCodester Employee Task Management System 1.0. Affected is an unknown function CVE-2023-09069.8A vulnerability classified as critical was found in SourceCodester Online Pizza Ordering System 1.0. Affected by this vulnerability is the f CVE-2023-09075.5A vulnerability, which was classified as problematic, has been found in Filseclab Twister Antivirus 8.17. Affected by this issue is the func