CVE-2023-1169

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

The OoohBoi Steroids for Elementor plugin for WordPress is vulnerable to missing authorization due to a missing capability check on the 'file_uploader_callback' function in versions up to, and including, 2.1.4. This makes it possible for subscriber-level attackers to upload image attachments to the site.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Jun 9, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-11706.6Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1376.CVE-2023-11726.1The Bookly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the full name value in versions up to, and including, 21.5 CVE-2023-11749.8This vulnerability exposes a network port in minikube running on macOS with Docker driver that could enable unexpected remote access to the CVE-2023-11756.6Incorrect Calculation of Buffer Size in GitHub repository vim/vim prior to 9.0.1378.CVE-2023-11763.3Absolute Path Traversal in GitHub repository mlflow/mlflow prior to 2.2.2.CVE-2023-11779.8Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.2.1.CVE-2023-11785.7An issue has been discovered in GitLab CE/EE affecting all versions from 8.6 before 15.9.6, all versions starting from 15.10 before 15.10.5,CVE-2023-11795.4A vulnerability, which was classified as problematic, was found in SourceCodester Computer Parts Sales and Inventory System 1.0. Affected is CVE-2023-11806.1A vulnerability has been found in SourceCodester Health Center Patient Record Management System 1.0 and classified as problematic. Affected CVE-2023-11815.4Cross-site Scripting (XSS) - Stored in GitHub repository icret/easyimages2.0 prior to 2.6.7.CVE-2023-11835.5A flaw was found in the Libreoffice package. An attacker can craft an odb containing a "database/script" file with a SCRIPT command where th CVE-2023-11848.8A vulnerability, which was classified as problematic, has been found in ECshop up to 4.1.8. Affected by this issue is some unknown functiona