CVE-2023-2168

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

The TaxoPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Suggest Terms Title field in versions up to, and including, 3.6.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with Editor+ permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Apr 19, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-216807.8Windows Win32k Elevation of Privilege VulnerabilityCVE-2023-216818.8Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution VulnerabilityCVE-2023-216825.3Windows Point-to-Point Protocol (PPP) Information Disclosure VulnerabilityCVE-2023-216837.5Windows Internet Key Exchange (IKE) Extension Denial of Service VulnerabilityCVE-2023-216848.8Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution VulnerabilityCVE-2023-216858.8Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution VulnerabilityCVE-2023-216868.8Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution VulnerabilityCVE-2023-216875.5HTTP.sys Information Disclosure VulnerabilityCVE-2023-216887.8NT OS Kernel Elevation of Privilege VulnerabilityCVE-2023-216899.8Microsoft Protected Extensible Authentication Protocol (PEAP) Remote Code Execution VulnerabilityCVE-2023-21694.8The TaxoPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Related Posts functionality in versions up to, and iCVE-2023-216909.8Microsoft Protected Extensible Authentication Protocol (PEAP) Remote Code Execution Vulnerability
CVE-2023-2168: Medium severity, CVSS 4.8 | Vulnix