CVE-2023-1069

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The Complianz WordPress plugin before 6.4.2, Complianz Premium WordPress plugin before 6.4.2 do not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Affected software

Vendor	Product	Versions
Unknown	Complianz	< 6.4.2
Unknown	Complianz Premium	< 6.4.2

References

https://wpscan.com/vulnerability/caacc50c-822e-46e9-bc0b-681349fd0ddaExploit, Third Party Advisory
https://wpscan.com/vulnerability/caacc50c-822e-46e9-bc0b-681349fd0ddaExploit, Third Party Advisory

Timeline

Published: Mar 27, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-10707.1External Control of File Name or Path in GitHub repository nilsteampassnet/teampass prior to 3.0.0.22.CVE-2023-10714.3An issue has been discovered in GitLab affecting all versions from 15.5 before 15.8.5, all versions starting from 15.9 before 15.9.4, all ve CVE-2023-10725.3An issue has been discovered in GitLab affecting all versions starting from 9.0 before 15.7.8, all versions starting from 15.8 before 15.8.4 CVE-2023-10736.6A memory corruption flaw was found in the Linux kernel’s human interface device (HID) subsystem in how a user inserts a malicious USB device CVE-2023-10745.5A memory leak flaw was found in the Linux kernel's Stream Control Transmission Protocol. This issue may occur when a user starts a malicious CVE-2023-10753.3A flaw was found in the Linux Kernel. The tls_is_tx_ready() incorrectly checks for list emptiness, potentially accessing a type confused ent CVE-2023-10765.5A flaw was found in the Linux Kernel. The tun/tap sockets have their socket UID hardcoded to 0 due to a type confusion in their initializati CVE-2023-10777.0In the Linux kernel, pick_next_rt_entity() may return a type confused entry, not detected by the BUG_ON condition, as the confused entry wil CVE-2023-10787.8A flaw was found in the Linux Kernel in RDS (Reliable Datagram Sockets) protocol. The rds_rm_zerocopy_callback() uses list_entry() on the he CVE-2023-10796.8A flaw was found in the Linux kernel. A use-after-free may be triggered in asus_kbd_backlight_set when plugging/disconnecting in a malicious CVE-2023-10806.1The GN Publisher plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘tab’ parameter in versions up to, and includi CVE-2023-10814.8Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.3.3.