CVE-2023-2320

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The CF7 Google Sheets Connector WordPress plugin before 5.0.2, cf7-google-sheets-connector-pro WordPress plugin through 5.0.2 does not escape a parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected software

No affected versions have been published.

Timeline

Published: Jul 4, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-232055.5An issue was discovered in lib60870 v2.3.2. There is a memory leak in lib60870/lib60870-C/examples/multi_client_server/multi_client_server.c CVE-2023-232086.1Genesys Administrator Extension (GAX) before 9.0.105.15 is vulnerable to Cross Site Scripting (XSS) via the Business Structure page of the i CVE-2023-23216.1The WPForms Google Sheet Connector WordPress plugin before 3.4.6, gsheetconnector-wpforms-pro WordPress plugin through 3.4.6 does not escape CVE-2023-23225.4Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.21.CVE-2023-23235.4Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.21.CVE-2023-23246.1The Elementor Forms Google Sheet Connector WordPress plugin before 1.0.7, gsheetconnector-for-elementor-forms-pro WordPress plugin through 1 CVE-2023-23255.4Stored XSS Vulnerability in M-Files Classic Web versions before 23.10 and LTS Service Release Versions before 23.2 LTS SR4 and 23.8 LTS SR1a CVE-2023-23266.5The Gravity Forms Google Sheet Connector WordPress plugin before 1.3.5, gsheetconnector-gravityforms-pro WordPress plugin through 1.3.5 does CVE-2023-23275.4Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.21.CVE-2023-232776.1Snippet-box 1.0.0 is vulnerable to Cross Site Scripting (XSS). Remote attackers can render arbitrary web script or HTML from the "Snippet co CVE-2023-232799.8Canteen Management System 1.0 is vulnerable to SQL Injection via /php_action/getOrderReport.php.CVE-2023-23285.4Cross-site Scripting (XSS) - Generic in GitHub repository pimcore/pimcore prior to 10.5.21.