CVE-2023-2605

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The wpbrutalai WordPress plugin before 2.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against a logged in high privilege users such as admin.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected software

Vendor	Product	Versions
Unknown	wpbrutalai	< 2.0.1

References

http://packetstormsecurity.com/files/173734/WordPress-WP-Brutal-AI-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
https://wpscan.com/vulnerability/372cb940-71ba-4d19-b35a-ab15f8c2fdebExploit, Third Party Advisory
http://packetstormsecurity.com/files/173734/WordPress-WP-Brutal-AI-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
https://wpscan.com/vulnerability/372cb940-71ba-4d19-b35a-ab15f8c2fdebExploit, Third Party Advisory

Timeline

Published: Jun 27, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-260514.3Saleor is a headless, GraphQL commerce platform delivering personalized shopping experiences. Some internal Python exceptions are not handle CVE-2023-260525.3Saleor is a headless, GraphQL commerce platform delivering personalized shopping experiences. Some internal Python exceptions are not handle CVE-2023-260539.8Gradle is a build tool with a focus on build automation and support for multi-language development. This is a collision attack on long IDs (CVE-2023-260546.5BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. In affected versions CVE-2023-260559.9XWiki Commons are technical libraries common to several other top level XWiki projects. Starting in version 3.1-milestone-1, any user can ed CVE-2023-260565.4XWiki Platform is a generic wiki platform. Starting in version 3.0-milestone-1, it's possible to execute a script with the right of another CVE-2023-260576.5An XXE issue was discovered in Nokia NetAct before 22 FP2211 via an XML document to the Configuration Dashboard page. Input validation and a CVE-2023-260586.5An XXE issue was discovered in Nokia NetAct before 22 FP2211 via an XML document to a Performance Manager page. Input validation and a prope CVE-2023-260595.4An issue was discovered in Nokia NetAct before 22 SP1037. On the Site Configuration Tool tab, attackers can upload a ZIP file which, when pr CVE-2023-26064.8The WP Brutal AI WordPress plugin before 2.06 does not sanitise and escape some of its settings, which could allow high privilege users such CVE-2023-260608.8An issue was discovered in Nokia NetAct before 22 FP2211. On the Working Set Manager page, users can create a Working Set with a name that h CVE-2023-260615.4An issue was discovered in Nokia NetAct before 22 FP2211. On the Scheduled Search tab under the Alarm Reports Dashboard page, users can crea