CVE-2023-3130

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

The Short URL WordPress plugin before 1.6.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Affected software

No affected versions have been published.

Timeline

Published: Jul 31, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-313007.5An issue was discovered in Sesami Cash Point & Transport Optimizer (CPTO) version 6.3.8.6 (#718), allows remote attackers to obtain sensitiv CVE-2023-313016.1Stored Cross Site Scripting (XSS) Vulnerability in Sesami Cash Point & Transport Optimizer (CPTO) version 6.3.8.6 (#718), allows remote atta CVE-2023-313026.1Cross Site Scripting (XSS) vulnerability in Sesami Cash Point & Transport Optimizer (CPTO) 6.3.8.6 (#718), allows remote attackers to execut CVE-2023-313042.3Improper input validation in SMU may allow an attacker with privileges and a compromised physical function (PF) to modify the PCIe® lan CVE-2023-313051.9Generation of weak and predictable Initialization Vector (IV) in PMFW (Power Management Firmware) may allow an attacker with privileges to r CVE-2023-313063.3Improper validation of an array index in the AMD graphics driver software could allow an attacker to pass malformed arguments to the dynamic CVE-2023-313074.4Improper validation of array index in Power Management Firmware (PMFW) may allow a privileged attacker to cause an out-of-bounds memory read CVE-2023-313083.3A malicious virtual function can invoke the certain command handlers in the SMU, causing a denial of service due to out-of-bounds memory rea CVE-2023-313096.8Improper validation in Power Management Firmware (PMFW) may allow an attacker with privileges to pass malformed workload arguments when expo CVE-2023-31314.3The MStore API WordPress plugin before 3.9.7 does not secure most of its AJAX actions by implementing privilege checks, nonce checks, or a c CVE-2023-313105.0Improper input validation in Power Management Firmware (PMFW) may allow an attacker with privileges to send a malformed input for the "set t CVE-2023-313137.2An unintended proxy or intermediary in the AMD power management firmware (PMFW) could allow a privileged attacker to send malformed messages