CVE-2023-1274

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

The Pricing Tables For WPBakery Page Builder (formerly Visual Composer) WordPress plugin before 3.0 does not validate some shortcode attributes before using them to generate paths passed to include function/s, allowing any authenticated users such as subscriber to perform LFI attacks

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected software

No affected versions have been published.

Timeline

Published: Apr 17, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-12756.1A vulnerability classified as problematic was found in SourceCodester Phone Shop Sales Managements System 1.0. This vulnerability affects un CVE-2023-12767.2A vulnerability, which was classified as critical, has been found in SUL1SS_shop. This issue affects some unknown processing of the file app CVE-2023-12777.8A vulnerability, which was classified as critical, was found in kylin-system-updater up to 1.4.20kord on Ubuntu Kylin. Affected is the funct CVE-2023-12786.1A vulnerability, which was classified as problematic, has been found in IBOS up to 4.5.5. Affected by this issue is some unknown functionali CVE-2023-12796.1An issue has been discovered in GitLab affecting all versions starting from 4.1 before 16.1.5, all versions starting from 16.2 before 16.2.5 CVE-2023-12817.8Use After Free vulnerability in Linux kernel traffic control index filter (tcindex) allows Privilege Escalation. The imperfect hash area can CVE-2023-12826.1The Drag and Drop Multiple File Upload PRO - Contact Form 7 Standard WordPress plugin before 2.11.1 and Drag and Drop Multiple File Upload P CVE-2023-12839.8Code Injection in GitHub repository builderio/qwik prior to 0.21.0.CVE-2023-12855.9Signal Handler Race Condition vulnerability in Mitsubishi Electric India GC-ENET-COM whose first 2 digits of 11-digit serial number of unit CVE-2023-12864.8Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.19.CVE-2023-12879.8An XSL template vulnerability in ENOVIA Live Collaboration V6R2013xE allows Remote Code Execution.CVE-2023-12887.5An XML External Entity injection (XXE) vulnerability in ENOVIA Live Collaboration V6R2013xE allows an attacker to read local files on the se