CVE-2023-1110

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The Yellow Yard Searchbar WordPress plugin before 2.8.12 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Affected software

No affected versions have been published.

Timeline

Published: Aug 16, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-11114.8A vulnerability was found in FastCMS up to 0.1.5 and classified as problematic. Affected by this issue is some unknown functionality of the CVE-2023-11129.8A vulnerability was found in Drag and Drop Multiple File Upload Contact Form 7 5.0.6.1 on WordPress. It has been classified as critical. Aff CVE-2023-11134.8A vulnerability was found in SourceCodester Simple Payroll System 1.0. It has been declared as problematic. Affected by this vulnerability i CVE-2023-11149.8Missing Authorization vulnerability in Eskom e-Belediye allows Information Elicitation. This issue affects e-Belediye: from 1.0.0.95 before CVE-2023-11155.4Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.18.CVE-2023-11165.4Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.18.CVE-2023-11175.4Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.18.CVE-2023-11187.8A flaw use after free in the Linux kernel integrated infrared receiver/transceiver driver was found in the way user detaching rc device. A l CVE-2023-11196.1The WP-Optimize WordPress plugin before 3.2.13, SrbTransLatin WordPress plugin before 2.4.1 use a third-party library that removes the escap CVE-2023-11204.8The Simple Giveaways WordPress plugin before 2.45.1 does not sanitise and escape some of its settings, which could allow high privilege user CVE-2023-11214.8The Simple Giveaways WordPress plugin before 2.45.1 does not sanitise and escape some of its settings, which could allow high privilege user CVE-2023-11224.8The Simple Giveaways WordPress plugin before 2.45.1 does not sanitise and escape some of its Giveaways options, which could allow high privi