CVE-2023-2277

MediumCVSS 4.7/10Last modified Jun 17, 2026

Description

The WP Directory Kit plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.9. This is due to missing or incorrect nonce validation on the 'insert' function. This makes it possible for unauthenticated attackers to update the plugin's settings and inject malicious JavaScript via a forged request, granted they can trick a site administrator into performing an action such as clicking on a link.

Metrics

CVSS 3.1 4.7/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published: Jun 13, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-227707.2Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilitie CVE-2023-227712.4An insufficient session expiration vulnerability exists in the ArubaOS command line interface. Successful exploitation of this vulnerability CVE-2023-227726.5An authenticated path traversal vulnerability exists in the ArubaOS web-based management interface. Successful exploitation of this vulnerab CVE-2023-227736.5Authenticated path traversal vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities r CVE-2023-227746.5Authenticated path traversal vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities r CVE-2023-227756.5A vulnerability exists which allows an authenticated attacker to access sensitive information on the ArubaOS command line interface. Success CVE-2023-227764.9An authenticated path traversal vulnerability exists in the ArubaOS command line interface. Successful exploitation of this vulnerability re CVE-2023-227776.5An authenticated information disclosure vulnerability exists in the ArubaOS web-based management interface. Successful exploitation of this CVE-2023-227784.8A vulnerability in the ArubaOS web management interface could allow an authenticated remote attacker to conduct a stored cross-site scriptin CVE-2023-227799.8There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sendin CVE-2023-22789.8The WP Directory Kit plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 1.1.9 via the 'wdk_public_CVE-2023-227809.8There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sendin