CVE-2023-1414

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

The WP VR WordPress plugin before 8.3.0 does not have authorisation and CSRF checks in various AJAX actions, one in particular could allow any authenticated users, such as subscriber to update arbitrary tours

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-352 CWE-862

Affected software

Vendor	Product	Versions
Unknown	WP VR	< 8.3.0

References

https://wpscan.com/vulnerability/d61d4be7-9251-4c62-8fb7-8a456aa6969eExploit, Third Party Advisory
https://wpscan.com/vulnerability/d61d4be7-9251-4c62-8fb7-8a456aa6969eExploit, Third Party Advisory

Timeline

Published: Apr 24, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-14158.8A vulnerability was found in Simple Art Gallery 1.0. It has been declared as critical. This vulnerability affects the function sliderPicSubm CVE-2023-14169.8A vulnerability classified as critical has been found in Simple Art Gallery 1.0. Affected is an unknown function of the file adminHome.php. CVE-2023-14174.3An issue has been discovered in GitLab affecting all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.1 CVE-2023-14186.1A vulnerability classified as problematic was found in SourceCodester Friendly Island Pizza Website and Ordering System 1.0. Affected by thi CVE-2023-14195.9A script injection vulnerability was found in the Debezium database connector, where it does not properly sanitize some parameters. This fla CVE-2023-14206.1The Ajax Search Lite WordPress plugin before 4.11.1, Ajax Search Pro WordPress plugin before 4.26.2 does not sanitise and escape a parameter CVE-2023-14216.1A reflected cross-site scripting vulnerability in the OAuth flow completion endpoints in Mattermost allows an attacker to send AJAX requests CVE-2023-14248.1Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series C CVE-2023-14257.2The WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg WordPress plugin before 2.7.9.4 does not properly CVE-2023-14266.5The WP Tiles WordPress plugin through 1.1.2 does not ensure that posts to be displayed are not draft/private, allowing any authenticated use CVE-2023-14274.9- The Photo Gallery by 10Web WordPress plugin before 1.8.15 did not ensure that uploaded files are kept inside its uploads folder, allowing CVE-2023-14287.5There exists an vulnerability causing an abort() to be called in gRPC. The following headers cause gRPC's C++ implementation to abort() whe