CVE-2023-0955

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

The WP Statistics WordPress plugin before 14.0 does not escape a parameter, which could allow authenticated users to perform SQL Injection attacks. By default, the affected feature is available to users with the manage_options capability (admin+), however the plugin has a settings to allow low privilege users to access it as well.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected software

No affected versions have been published.

Timeline

Published: Mar 27, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-09567.5External input could be used on TEL-STER TelWin SCADA WebInterface to construct paths to files and directories without properly neutralizing CVE-2023-09579.6An issue was discovered in Gitpod versions prior to release-2022.11.2.16. There is a Cross-Site WebSocket Hijacking (CSWSH) vulnerability th CVE-2023-09586.5Several plugins for WordPress by Inisev are vulnerable to unauthorized installation of plugins due to a missing capability check on the hand CVE-2023-09596.5Bhima version 1.27.0 allows a remote attacker to update the privileges of any account registered in the application via a malicious link sen CVE-2023-09609.8A vulnerability was found in SeaCMS 11.6 and classified as problematic. Affected by this issue is some unknown functionality of the file /da CVE-2023-09619.8A vulnerability was found in SourceCodester Music Gallery Site 1.0. It has been classified as critical. This affects an unknown part of the CVE-2023-09628.8A vulnerability was found in SourceCodester Music Gallery Site 1.0. It has been declared as critical. This vulnerability affects unknown cod CVE-2023-09639.8A vulnerability was found in SourceCodester Music Gallery Site 1.0. It has been rated as critical. This issue affects some unknown processin CVE-2023-09648.1A vulnerability classified as critical has been found in SourceCodester Sales Tracker Management System 1.0. Affected is an unknown function CVE-2023-09657.5Compiler removal of buffer clearing in sli_cryptoacc_transparent_key_agreement in Silicon Labs Gecko Platform SDK v4.2.1 and earlier results CVE-2023-09668.8A vulnerability classified as problematic was found in SourceCodester Online Eyewear Shop 1.0. Affected by this vulnerability is an unknown CVE-2023-09676.5Bhima version 1.27.0 allows an attacker authenticated with normal user permissions to view sensitive data of other application users and dat