CVE-2023-2309

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The wpForo Forum WordPress plugin before 2.1.9 does not escape some request parameters while in debug mode, leading to a Reflected Cross-Site Scripting vulnerability.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected software

No affected versions have been published.

Timeline

Published
Jul 24, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-23105.3A Channel Accessible by Non-Endpoint vulnerability in the Schweitzer Engineering Laboratories SEL Real-Time Automation Controller (RTAC) couCVE-2023-231087.5In crasm 1.8-3, invalid input validation, specific files passed to the command line application, can lead to a NULL pointer dereference in tCVE-2023-231097.5In crasm 1.8-3, invalid input validation, specific files passed to the command line application, can lead to a divide by zero fault in the fCVE-2023-23116.5Insufficient policy enforcement in File System API in Google Chrome prior to 112.0.5615.49 allowed a remote attacker to bypass filesystem reCVE-2023-231107.4An exploitable firmware modification vulnerability was discovered in certain Netgear products. The data integrity of the uploaded firmware iCVE-2023-231195.9The use of the cyclic redundancy check (CRC) algorithm for integrity check during firmware update makes Ubiquiti airFiber AF2X Radio firmwarCVE-2023-23128.8Use after free in Offline in Google Chrome on Android prior to 116.0.5845.96 allowed a remote attacker who had compromised the renderer procCVE-2023-231205.9The use of the cyclic redundancy check (CRC) algorithm for integrity check during firmware update makes TRENDnet TV-IP651WI Network Camera fCVE-2023-231266.1Connectwise Automate 2022.11 is vulnerable to Clickjacking. The login screen can be iframed and used to manipulate users to perform unintendCVE-2023-231275.3In Connectwise Control 22.8.10013.8329, the login page does not implement HSTS headers therefore not enforcing HTTPS. NOTE: the vendor's posCVE-2023-231286.1Connectwise Control 22.8.10013.8329 is vulnerable to Cross Origin Resource Sharing (CORS). The vendor's position is that two endpoints have CVE-2023-23138.8Inappropriate implementation in Sandbox in Google Chrome on Windows prior to 112.0.5615.49 allowed a remote attacker who had compromised the
CVE-2023-2309: Medium severity, CVSS 6.1 | Vulnix