CVE-2023-1373

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The W4 Post List WordPress plugin before 2.4.6 does not escape some URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected software

Vendor	Product	Versions
Unknown	W4 Post List	< 2.4.6

References

https://wpscan.com/vulnerability/fa38f3e6-e04c-467c-969b-0f6736087589Exploit, Third Party Advisory
https://wpscan.com/vulnerability/fa38f3e6-e04c-467c-969b-0f6736087589Exploit, Third Party Advisory

Timeline

Published: Apr 17, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-13744.8The Solidres plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'currency_name' parameter in versions up to, and incl CVE-2023-13754.3The WP Fastest Cache plugin for WordPress is vulnerable to unauthorized cache deletion in versions up to, and including, 1.1.2 due to a miss CVE-2023-13776.1The Solidres WordPress plugin through 0.9.4 does not sanitise and escape numerous parameter before outputting them back in pages, leading to CVE-2023-13789.8A vulnerability classified as critical was found in SourceCodester Friendly Island Pizza Website and Ordering System 1.0. This vulnerability CVE-2023-13799.8A vulnerability was found in SourceCodester Friendly Island Pizza Website and Ordering System 1.0. It has been rated as critical. This issue CVE-2023-13807.1A slab-out-of-bound read problem was found in brcmf_get_assoc_ies in drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c in the Linu CVE-2023-13818.8The WP Meta SEO WordPress plugin before 4.5.5 does not validate image file paths before attempting to manipulate the image files, leading to CVE-2023-13824.7A data race flaw was found in the Linux kernel, between where con is allocated and con->sock is set. This issue leads to a NULL pointer dere CVE-2023-13834.3An Improper Enforcement of Behavioral Workflow vulnerability in the exchangeDeviceServices function on the amzn.dmgr service allowed an atta CVE-2023-13846.1The setMediaSource function on the amzn.thin.pl service does not sanitize the "source" parameter allowing for arbitrary javascript code to b CVE-2023-13858.8Improper JPAKE implementation allows offline PIN brute-forcing due to the initialization of random values to a known value, which leads to u CVE-2023-13867.8A flaw was found in the 9p passthrough filesystem (9pfs) implementation in QEMU. When a local user in the guest writes an executable file wi