CVE-2023-3055

MediumCVSS 4.3/10Last modified Oct 28, 2026

Description

The Page Builder by AZEXO plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.27.133. This is due to missing or incorrect nonce validation on the 'azh_save' function. This makes it possible for unauthenticated attackers to update the post content and inject malicious JavaScript via a forged request, granted they can trick a site administrator into performing an action such as clicking on a link.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
azexo	Page Builder with Image Map by AZEXO	<= 1.27.133

References

Timeline

Published: Jun 3, 2023
Last modified: Oct 28, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-305504.5MeterSphere is an open source continuous testing platform, covering functions such as test tracking, interface testing, UI testing, and perf CVE-2023-305517.5Rekor is an open source software supply chain transparency log. Rekor prior to version 1.1.1 may crash due to out of memory (OOM) conditions CVE-2023-305526.5Archery is an open source SQL audit platform. The Archery project contains multiple SQL injection vulnerabilities, that may allow an attacke CVE-2023-305536.5Archery is an open source SQL audit platform. The Archery project contains multiple SQL injection vulnerabilities, that may allow an attacke CVE-2023-305546.5Archery is an open source SQL audit platform. The Archery project contains multiple SQL injection vulnerabilities, that may allow an attacke CVE-2023-305556.5Archery is an open source SQL audit platform. The Archery project contains multiple SQL injection vulnerabilities, that may allow an attacke CVE-2023-305566.5Archery is an open source SQL audit platform. The Archery project contains multiple SQL injection vulnerabilities, that may allow an attacke CVE-2023-305576.5Archery is an open source SQL audit platform. The Archery project contains multiple SQL injection vulnerabilities, that may allow an attacke CVE-2023-305586.5Archery is an open source SQL audit platform. The Archery project contains multiple SQL injection vulnerabilities, that may allow an attacke CVE-2023-305595.7The firmware update package for the wireless card is not properly signed and can be modified.CVE-2023-30569.8A vulnerability was found in YFCMF up to 3.0.4. It has been declared as problematic. This vulnerability affects unknown code of the file ind CVE-2023-305606.8The configuration from the PCU can be modified without authentication using physical connection to the PCU.