CVE-2023-3136

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The MailArchiver plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an email subject in versions up to, and including, 2.10.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Aug 30, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-313607.3Incorrect default permissions in the AMD Integrated Management Technology (AIM-T) Manageability Service installation directory could allow a CVE-2023-313617.3A DLL hijacking vulnerability in AMD Integrated Management Technology (AIM-T) Manageability Service could allow an attacker to achieve privi CVE-2023-313648.3Improper handling of direct memory writes in the input-output memory management unit could allow a malicious guest virtual machine (VM) to f CVE-2023-313653.9An integer overflow in the SMU could allow a privileged attacker to potentially write memory beyond the end of the reserved dRAM area result CVE-2023-313665.5Improper input validation in AMD μProf could allow an attacker to perform a write to an invalid address, potentially resulting in denial of CVE-2023-31387.5A vulnerability was found in libX11. The security flaw occurs because the functions in src/InitExt.c in libX11 do not check that the values CVE-2023-31396.1The Protect WP Admin WordPress plugin before 4.0 discloses the URL of the admin panel via a redirection of a crafted URL, bypassing the prot CVE-2023-31404.3Missing HTTP headers (X-Frame-Options, Content-Security-Policy) in KNIME Business Hub before 1.4.0 has left users vulnerable to click jack CVE-2023-314038.0SAP Business One installation - version 10.0, does not perform proper authentication and authorization checks for SMB shared folder. As a re CVE-2023-314045.0Under certain conditions, SAP BusinessObjects Business Intelligence Platform (Central Management Service) - versions 420, 430, allows an att CVE-2023-314055.3SAP NetWeaver AS for Java - versions ENGINEAPI 7.50, SERVERCORE 7.50, J2EE-APPS 7.50, allows an unauthenticated attacker to craft a request CVE-2023-314066.1Due to insufficient input validation, SAP BusinessObjects Business Intelligence Platform - versions 420, 430, allows an unauthenticated atta