First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2023-1804

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The Product Catalog Feed by PixelYourSite WordPress plugin before 2.1.1 does not sanitise and escape the edit parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as administrators.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

Affected software

Vendor	Product	Versions
Unknown	Product Catalog Feed by PixelYourSite	< 2.1.1

References

Timeline

Published: May 2, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-18056.1The Product Catalog Feed by PixelYourSite WordPress plugin before 2.1.1 does not sanitise and escape the page parameter before outputting it CVE-2023-18066.1The WP Inventory Manager WordPress plugin before 2.1.0.12 does not sanitise and escape the message parameter before outputting it back in th CVE-2023-18074.3The Elementor Addons, Widgets and Enhancements – Stax plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, an CVE-2023-18097.5The Download Manager WordPress plugin before 6.3.0 leaks master key information without the need for a password, allowing attackers to downl CVE-2023-18108.8Heap buffer overflow in Visuals in Google Chrome prior to 112.0.5615.49 allowed a remote attacker who had compromised the renderer process t CVE-2023-18118.8Use after free in Frames in Google Chrome prior to 112.0.5615.49 allowed a remote attacker who convinced a user to engage in specific UI int CVE-2023-18128.8Out of bounds memory access in DOM Bindings in Google Chrome prior to 112.0.5615.49 allowed a remote attacker to perform out of bounds memor CVE-2023-18136.5Inappropriate implementation in Extensions in Google Chrome prior to 112.0.5615.49 allowed an attacker who convinced a user to install a mal CVE-2023-18146.5Insufficient validation of untrusted input in Safe Browsing in Google Chrome prior to 112.0.5615.49 allowed a remote attacker to bypass down CVE-2023-18158.8Use after free in Networking APIs in Google Chrome prior to 112.0.5615.49 allowed a remote attacker who convinced a user to engage in specif CVE-2023-18166.5Incorrect security UI in Picture In Picture in Google Chrome prior to 112.0.5615.49 allowed a remote attacker to potentially perform navigat CVE-2023-18176.5Insufficient policy enforcement in Intents in Google Chrome on Android prior to 112.0.5615.49 allowed a remote attacker to bypass navigation

CVE-2023-1804: Medium severity, CVSS 6.1 | Vulnix