CVE-2023-3387

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The Lana Text to Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'lana_text_to_image' and 'lana_text_to_img' shortcode in versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
lanacodesLana Text to Image<= 1.0.0

References

Timeline

Published
Jun 24, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-338707.8Insecure inherited permissions in some Intel(R) Ethernet tools and driver install software may allow an authenticated user to potentially enCVE-2023-338717.5Iagona ScrutisWeb versions 2.1.37 and prior are vulnerable to a directory traversal vulnerability that could allow an unauthenticated user tCVE-2023-338725.5Improper access control in the Intel Support android application all verions may allow an authenticated user to potentially enable informatiCVE-2023-338737.8This privilege escalation vulnerability, if exploited, cloud allow a local OS-authenticated user with standard privileges to escalate to SysCVE-2023-338747.3Uncontrolled search path in some Intel(R) NUC 12 Pro Kits & Mini PCs - NUC12WS Intel(R) HID Event Filter Driver installation software beforeCVE-2023-338755.5Improper access control for some Intel(R) PROSet/Wireless and Intel(R) Killer(TM) Wi-Fi software before version 22.240 may allow an unauthenCVE-2023-338768.8A use-after-free vulnerability exists in the way Foxit Reader 12.1.2.15332 handles destroying annotations. Specially crafted Javascript codeCVE-2023-338777.8Out-of-bounds write in some Intel(R) RealSense(TM) ID software for Intel(R) RealSense(TM) 450 FA in version 0.25.0 may allow an authenticateCVE-2023-338787.8Path transversal in some Intel(R) NUC P14E Laptop Element Audio Install Package software before version 156 for Windows may allow an authentCVE-2023-338793.3In music service, there is a missing permission check. This could lead to local information disclosure with no additional execution privilegCVE-2023-33886.1The Beautiful Cookie Consent Banner for WordPress is vulnerable to Stored Cross-Site Scripting via the 'nsc_bar_content_href' parameter in vCVE-2023-338803.3In music service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileg