CVE-2023-3501

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

The FormCraft WordPress plugin before 1.2.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Affected software

Vendor	Product	Versions
Unknown	FormCraft	< 1.2.7

References

https://wpscan.com/vulnerability/d3fb4a2b-ed51-4654-b7c1-4b0f59cd1ecfExploit, Third Party Advisory
https://wpscan.com/vulnerability/d3fb4a2b-ed51-4654-b7c1-4b0f59cd1ecfExploit, Third Party Advisory

Timeline

Published: Aug 30, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-350115.4IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacke CVE-2023-350126.7IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 with a Federated configuration is vulnerable to a stack-based buffer CVE-2023-350134.4IBM Security Verify Governance 10.0, Identity Manager could allow a local privileged user to obtain sensitive information from source code. CVE-2023-350166.5IBM Security Verify Governance, Identity Manager 10.0 could allow a remote attacker to traverse directories on the system. An attacker could CVE-2023-350175.9IBM Security Verify Governance 10.0.2 Identity Manager can transmit user credentials in clear text that could be obtained by an attacker usi CVE-2023-350187.2IBM Security Verify Governance 10.0 could allow a privileged use to upload arbitrary files due to improper file validation. IBM X-Force ID:CVE-2023-350198.8IBM Security Verify Governance, Identity Manager 10.0 could allow a remote authenticated attacker to execute arbitrary commands on the syste CVE-2023-35027.5A vulnerability, which was classified as critical, was found in SourceCodester Shopping Website 1.0. Affected is an unknown function of the CVE-2023-350205.3IBM Sterling Control Center 6.3.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially cr CVE-2023-350223.3IBM InfoSphere Information Server 11.7 could allow a local user to update projects that they do not have the authorization to access. IBM X CVE-2023-350247.6IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1 CVE-2023-350296.1Open redirect vulnerability in the Layout module's SEO configuration in Liferay Portal 7.4.3.70 through 7.4.3.76, and Liferay DXP 7.4 update