CVE-2023-2812

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

The Ultimate Dashboard WordPress plugin before 3.7.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Affected software

No affected versions have been published.

Timeline

Published
Jun 19, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-281205.3There is a vulnerability in ActiveSupport if the new bytesplice method is called on a SafeBuffer with untrusted user input.CVE-2023-281219.8An issue in WooCommerce Payments plugin for WordPress (versions 5.6.1 and lower) allows an unauthenticated attacker to send requests on behaCVE-2023-281227.8A local privilege escalation (LPE) vulnerability in UI Desktop for Windows (Version 0.59.1.71 and earlier) allows a malicious actor with locCVE-2023-281235.5A permission misconfiguration in UI Desktop for Windows (Version 0.59.1.71 and earlier) could allow an user to hijack VPN credentials while CVE-2023-281245.5Improper usage of symmetric encryption in UI Desktop for Windows (Version 0.59.1.71 and earlier) could allow users with access to UI DesktopCVE-2023-281255.9An improper authentication vulnerability exists in Avalanche Premise versions 6.3.x and below that could allow an attacker to gain access toCVE-2023-281265.9An authentication bypass vulnerability exists in Avalanche versions 6.3.x and below that could allow an attacker to gain access by exploitinCVE-2023-281277.5A path traversal vulnerability exists in Avalanche version 6.3.x and below that when exploited could result in possible information disclosuCVE-2023-281287.2An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.3.x and below that could allow an attacker tCVE-2023-281297.8DSM 2022.2 SU2 and all prior versions allows a local low privileged account to execute arbitrary OS commands as the DSM software installatioCVE-2023-28136.1All of the above Aapna WordPress theme through 1.3, Anand WordPress theme through 1.2, Anfaust WordPress theme through 1.1, Arendelle WordPrCVE-2023-281307.2Local user may lead to privilege escalation using Gaia Portal hostnames page.