CVE-2023-2579

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The InventoryPress WordPress plugin through 1.7 does not sanitise and escape some of its settings, which could allow users with the role of author and above to perform Stored Cross-Site Scripting attacks.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Affected software

Vendor	Product	Versions
Unknown	InventoryPress	<= 1.7

References

https://github.com/daniloalbuqrque/poc-cve-xss-inventory-press-pluginExploit, Third Party Advisory
https://wpscan.com/vulnerability/3cfcb8cc-9c4f-409c-934f-9f3f043de6feExploit, Third Party Advisory
https://github.com/daniloalbuqrque/poc-cve-xss-inventory-press-pluginExploit, Third Party Advisory
https://wpscan.com/vulnerability/3cfcb8cc-9c4f-409c-934f-9f3f043de6feExploit, Third Party Advisory

Timeline

Published: Jul 17, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-257905.3Improper Authentication, Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in xtemos WoodMa CVE-2023-257915.4Missing Authorization vulnerability in Cadus Pro Fontiran allows Exploiting Incorrectly Configured Access Control Security Levels.This issue CVE-2023-257924.8Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in XiaoMac WP Open Social plugin <= 5.0 versions.CVE-2023-257934.8Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in George Pattihis Link Juice Keeper plugin <= 2.0.2 versions.CVE-2023-257944.8Auth. (admin+) Cross-Site Scripting (XSS) vulnerability in Mighty Digital Nooz plugin <= 1.6.0 versions.CVE-2023-257954.8Auth. (admin+) Cross-Site Scripting (XSS) vulnerability in WP-master.Ir Feed Changer & Remover plugin <= 0.2 versions.CVE-2023-257964.8Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Include WP BaiDu Submit plugin <= 1.2.1 versions.CVE-2023-257974.8Auth. Stored Cross-Site Scripting (XSS) vulnerability in Mr.Vibe vSlider Multi Image Slider for WordPress plugin <= 4.1.2 versions.CVE-2023-257985.4Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Olevmedia Olevmedia Shortcodes plugin <= 1.1.9 versions.CVE-2023-257998.8Missing Authorization vulnerability in Themeum Tutor LMS.This issue affects Tutor LMS: from n/a through 2.1.8.CVE-2023-25804.8The AI Engine WordPress plugin before 1.6.83 does not sanitize and escape some of its settings, which could allow high-privilege users such CVE-2023-258008.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeum Tutor LMS allows SQL Injection