CVE-2023-2326

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

The Gravity Forms Google Sheet Connector WordPress plugin before 1.3.5, gsheetconnector-gravityforms-pro WordPress plugin through 1.3.5 does not have CSRF check when updating its Access Code, which could allow attackers to make logged in admin change the access code to an arbitrary one via a CSRF attack

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Affected software

No affected versions have been published.

Timeline

Published: Jun 27, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-23275.4Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.21.CVE-2023-232776.1Snippet-box 1.0.0 is vulnerable to Cross Site Scripting (XSS). Remote attackers can render arbitrary web script or HTML from the "Snippet co CVE-2023-232799.8Canteen Management System 1.0 is vulnerable to SQL Injection via /php_action/getOrderReport.php.CVE-2023-23285.4Cross-site Scripting (XSS) - Generic in GitHub repository pimcore/pimcore prior to 10.5.21.CVE-2023-232866.1Cross Site Scripting (XSS) vulnerability in Provide server 14.4 allows attackers to execute arbitrary code through the server-log via userna CVE-2023-23298.8The WooCommerce Google Sheet Connector WordPress plugin before 1.3.6 does not have CSRF check when updating its Access Code, which could all CVE-2023-232948.8Korenix JetWave 4200 Series 1.3.0 and JetWave 3000 Series 1.6.0 are vulnerable to Command Injection. An attacker can modify the file_name pa CVE-2023-232958.8Korenix Jetwave 4200 Series 1.3.0 and JetWave 3000 Series 1.6.0 are vulnerable to Command Injection via /goform/formSysCmd. An attacker an m CVE-2023-232966.5Korenix JetWave 4200 Series 1.3.0 and JetWave 3200 Series 1.6.0 are vulnerable to Denial of Service via /goform/formDefault.CVE-2023-232989.8The `Toybox.Graphics.BufferedBitmap.initialize` API method in CIQ API version 2.3.0 through 4.1.7 does not validate its parameters, which ca CVE-2023-232997.5The permission system implemented and enforced by the GarminOS TVM component in CIQ API version 1.0.0 through 4.1.7 can be bypassed entirely CVE-2023-23308.8The Caldera Forms Google Sheets Connector WordPress plugin before 1.3 does not have CSRF check when updating its Access Code, which could al