CVE-2023-0911

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

The WordPress Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 5.12.8 does not validate the user meta to be retrieved via the user shortcode, allowing any authenticated users such as subscriber to retrieve arbitrary user meta (except the user_pass), such as the user email and activation key by default.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Mar 20, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-09128.8A vulnerability classified as critical has been found in SourceCodester Auto Dealer Management System 1.0. This affects an unknown part of t CVE-2023-09138.8A vulnerability classified as critical was found in SourceCodester Auto Dealer Management System 1.0. This vulnerability affects unknown cod CVE-2023-09145.3Improper Authorization in GitHub repository pixelfed/pixelfed prior to 0.11.4.CVE-2023-09158.8A vulnerability classified as critical has been found in SourceCodester Auto Dealer Management System 1.0. Affected is an unknown function o CVE-2023-09168.8A vulnerability classified as critical was found in SourceCodester Auto Dealer Management System 1.0. Affected by this vulnerability is an u CVE-2023-09179.8A vulnerability, which was classified as critical, was found in SourceCodester Simple Customer Relationship Management System 1.0. This affe CVE-2023-09189.8A vulnerability has been found in codeprojects Pharmacy Management System 1.0 and classified as critical. This vulnerability affects unknown CVE-2023-09193.5Missing Authentication for Critical Function in GitHub repository kareadita/kavita prior to 0.7.0.CVE-2023-09214.3A lack of length validation in GitLab CE/EE affecting all versions from 8.3 before 15.10.8, 15.11 before 15.11.7, and 16.0 before 16.0.2 all CVE-2023-09225.9The Samba AD DC administration tool, when operating against a remote LDAP server, will by default send new or reset passwords over a signed-CVE-2023-09239.8A flaw was found in the Kubernetes service for notebooks in RHODS, where it does not prevent pods from other namespaces and applications fro CVE-2023-09247.2The ZYREX POPUP WordPress plugin through 1.0 does not validate the type of files uploaded when creating a popup, allowing a high privileged