CVE-2023-0937

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The VK All in One Expansion Unit WordPress plugin before 9.87.1.0 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected software

No affected versions have been published.

Timeline

Published: Mar 20, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-09389.8A vulnerability classified as critical has been found in SourceCodester Music Gallery Site 1.0. This affects an unknown part of the file mus CVE-2023-09399.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in NTN Information Technologies Online Se CVE-2023-09408.8The ProfileGrid WordPress plugin before 5.3.1 provides an AJAX endpoint for resetting a user password but does not implement proper authoriz CVE-2023-09418.8Use after free in Prompts in Google Chrome prior to 110.0.5481.177 allowed a remote attacker to potentially exploit heap corruption via a cr CVE-2023-09426.1The Japanized For WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘tab’ parameter in versions up to CVE-2023-09438.8A vulnerability, which was classified as problematic, has been found in SourceCodester Best POS Management System 1.0. This issue affects th CVE-2023-09444.3Bhima version 1.27.0 allows an authenticated attacker with regular user permissions to update arbitrary user session data such as username, CVE-2023-09455.4A vulnerability, which was classified as problematic, was found in SourceCodester Best POS Management System 1.0. Affected is an unknown fun CVE-2023-09469.8A vulnerability has been found in SourceCodester Best POS Management System 1.0 and classified as critical. Affected by this vulnerability i CVE-2023-09479.8Path Traversal in GitHub repository flatpressblog/flatpress prior to 1.3.CVE-2023-09486.1The Japanized For WooCommerce WordPress plugin before 2.5.8 does not escape generated URLs before outputting them in attributes, leading to CVE-2023-09494.8Cross-site Scripting (XSS) - Reflected in GitHub repository modoboa/modoboa prior to 2.0.5.