CVE-2023-2170

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

The TaxoPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Related Posts functionality in versions up to, and including, 3.6.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with Editor+ permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Apr 19, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-217007.5Windows iSCSI Discovery Service Denial of Service VulnerabilityCVE-2023-217017.5Microsoft Protected Extensible Authentication Protocol (PEAP) Denial of Service VulnerabilityCVE-2023-217027.5Windows iSCSI Service Denial of Service VulnerabilityCVE-2023-217037.2Azure Data Box Gateway Remote Code Execution VulnerabilityCVE-2023-217047.8Microsoft ODBC Driver for SQL Server Remote Code Execution VulnerabilityCVE-2023-217058.8Microsoft SQL Server Remote Code Execution VulnerabilityCVE-2023-217068.8Microsoft Exchange Server Remote Code Execution VulnerabilityCVE-2023-217078.8Microsoft Exchange Server Remote Code Execution VulnerabilityCVE-2023-217089.8Remote Procedure Call Runtime Remote Code Execution VulnerabilityCVE-2023-217099.8Microsoft Exchange Server Elevation of Privilege VulnerabilityCVE-2023-21715.4The BadgeOS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in versions up to, and includingCVE-2023-217107.2Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2023-2170: Medium severity, CVSS 4.8 | Vulnix