CVE-2023-2708

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The Video Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘search_term’ parameter in versions up to, and including, 1.0.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. CVE-2023-32597 may be a duplicate of this.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
nik00726	Video Gallery	<= 1.0.10

References

Timeline

Published: May 16, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-270824.8Cross Site Scripting (XSS) vulnerability in /admin.php in Pluck CMS 4.7.15 through 4.7.16-dev4 allows remote attackers to run arbitrary code CVE-2023-270837.2An issue discovered in /admin.php in Pluck CMS 4.7.15 through 4.7.16-dev5 allows remote attackers to run arbitrary code via manage file func CVE-2023-270845.3Permissions vulnerability found in isoftforce Dreamer CMS v.4.0.1 allows local attackers to obtain sensitive information via the AttachmentC CVE-2023-270877.5Permissions vulnerabiltiy found in Xuxueli xxl-job v2.2.0, v 2.3.0 and v.2.3.1 allows attacker to obtain sensitive information via the pageL CVE-2023-270888.8feiqu-opensource Background Vertical authorization vulnerability exists in IndexController.java. demo users with low permission can perform CVE-2023-270898.2Cross Site Scripting vulnerability found in Ehuacui BBS allows attackers to cause a denial of service via a crafted payload in the login par CVE-2023-27094.8The AN_GradeBook WordPress plugin through 5.0.1 does not sanitise and escape some of its settings, which could allow high privilege users su CVE-2023-270905.4Cross Site Scripting vulnerability found in TeaCMS storage allows attacker to cause a leak of sensitive information via the article title pa CVE-2023-270917.2An unauthorized access issue found in XiaoBingby TeaCMS 2.3.3 allows attackers to escalate privileges via the id and keywords parameter(s).CVE-2023-270926.1Cross Site Scripting vulnerability found in Jbootfly allows attackers to obtain sensitive information via the username parameter.CVE-2023-270936.1Cross Site Scripting vulnerability found in My-Blog allows attackers to cause a denial of service via the Post function.CVE-2023-270948.8An issue found in OpenGoofy Hippo4j v.1.4.3 allows attackers to escalate privileges via the ThreadPoolController of the tenant Management mo