CVE-2023-2580

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

The AI Engine WordPress plugin before 1.6.83 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example, in multisite setup).

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Affected software

Vendor	Product	Versions
Unknown	AI Engine: ChatGPT Chatbot, Content Generator, GPT 3 & 4, Ultra-Customizable	< 1.6.83

References

https://wpscan.com/vulnerability/7ee1efb1-9969-40b2-8ab2-ea427091bbd8Exploit, Third Party Advisory
https://wpscan.com/vulnerability/7ee1efb1-9969-40b2-8ab2-ea427091bbd8Exploit, Third Party Advisory

Timeline

Published: Jun 27, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-258008.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeum Tutor LMS allows SQL Injection CVE-2023-258017.8TensorFlow is an open source machine learning platform. Prior to versions 2.12.0 and 2.11.1, `nn_ops.fractional_avg_pool_v2` and `nn_ops.fra CVE-2023-258027.5Roxy-WI is a Web interface for managing Haproxy, Nginx, Apache, and Keepalived servers. Versions prior to 6.3.6.0 don't correctly neutralize CVE-2023-258037.5Roxy-WI is a Web interface for managing Haproxy, Nginx, Apache, and Keepalived servers. Versions prior to 6.3.5.0 have a directory traversal CVE-2023-258045.3Roxy-WI is a Web interface for managing Haproxy, Nginx, Apache, and Keepalived servers. Versions prior to 6.3.5.0 have a limited path traver CVE-2023-258059.8versionn, software for changing version information across multiple files, has a command injection vulnerability in all versions prior to ve CVE-2023-258065.3OpenSearch Security is a plugin for OpenSearch that offers encryption, authentication and authorization. There is an observable discrepancy CVE-2023-258075.4DataEase is an open source data visualization and analysis tool. When saving a dashboard on the DataEase platform saved data can be modified CVE-2023-258096.3runc is a CLI tool for spawning and running containers according to the OCI specification. In affected versions it was found that rootless r CVE-2023-258105.4Uptime Kuma is a self-hosted monitoring tool. In versions prior to 1.20.0 the Uptime Kuma status page allows a persistent XSS attack. Users CVE-2023-258115.4Uptime Kuma is a self-hosted monitoring tool. In versions prior to 1.20.0 the Uptime Kuma `name` parameter allows a persistent XSS attack. U CVE-2023-258128.8Minio is a Multi-Cloud Object Storage framework. Affected versions do not correctly honor a `Deny` policy on ByPassGoverance. Ideally, minio