CVE-2023-2087

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

The Essential Blocks plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.0.6. This is due to missing or incorrect nonce validation on the save function. This makes it possible for unauthenticated attackers to change plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
wpdevteam	Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns	<= 4.0.6

References

Timeline

Published: Jun 9, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-208706.0VMware Workstation and Fusion contain an out-of-bounds read vulnerability that exists in the functionality for sharing host Bluetooth device CVE-2023-208717.8VMware Fusion contains a local privilege escalation vulnerability. A malicious actor with read/write access to the host operating system can CVE-2023-208728.8VMware Workstation and Fusion contain an out-of-bounds read/write vulnerability in SCSI CD/DVD device emulation.CVE-2023-208739.8In Spring Boot versions 3.0.0 - 3.0.5, 2.7.0 - 2.7.10, and older unsupported versions, an application that is deployed to Cloud Foundry coul CVE-2023-208778.8VMware Aria Operations contains a privilege escalation vulnerability. An authenticated malicious user with ReadOnly privileges can perform c CVE-2023-208787.2VMware Aria Operations contains a deserialization vulnerability. A malicious actor with administrative privileges can execute arbitrary comm CVE-2023-208796.7VMware Aria Operations contains a Local privilege escalation vulnerability. A malicious actor with administrative privileges in the Aria Ope CVE-2023-20886.5A flaw was found in OpenStack due to an inconsistency between Cinder and Nova. This issue can be triggered intentionally or by accident. A r CVE-2023-208806.7VMware Aria Operations contains a privilege escalation vulnerability. A malicious actor with administrative access to the local system can e CVE-2023-208818.1Cloud foundry instances having CAPI version between 1.140 and 1.152.0 along with loggregator-agent v7+ may override other users syslog drain CVE-2023-208825.9In Cloud foundry routing release versions from 0.262.0 and prior to 0.266.0,a bug in the gorouter process can lead to a denial of service of CVE-2023-208837.5In Spring Boot versions 3.0.0 - 3.0.6, 2.7.0 - 2.7.11, 2.6.0 - 2.6.14, 2.5.0 - 2.5.14 and older unsupported versions, there is potential for