CVE-2023-4148

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The Ditty WordPress plugin before 3.1.25 does not sanitise and escape some parameters and generated URLs before outputting them back in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Sep 25, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-414848.1An issue in cimg.eu Cimg Library v2.9.3 allows an attacker to obtain sensitive information via a crafted JPEG file.CVE-2023-41499.8A vulnerability in the web-based management allows an unauthenticated remote attacker to inject arbitrary system commands and gain full syst CVE-2023-41504.3The User Activity Tracking and Log WordPress plugin before 4.0.9 does not have proper CSRF checks when managing its license, which could all CVE-2023-415039.8Student Enrollment In PHP v1.0 was discovered to contain a SQL injection vulnerability via the Login function.CVE-2023-415048.8SQL Injection vulnerability in Student Enrollment In PHP 1.0 allows attackers to run arbitrary code via the Student Search function.CVE-2023-415059.8An arbitrary file upload vulnerability in the Add Student's Profile Picture function of Student Enrollment In PHP v1.0 allows attackers to e CVE-2023-415069.8An arbitrary file upload vulnerability in the Update/Edit Student's Profile Picture function of Student Enrollment In PHP v1.0 allows attack CVE-2023-415079.8Super Store Finder v3.6 was discovered to contain multiple SQL injection vulnerabilities in the store locator component via the products, di CVE-2023-415089.8A hard coded password in Super Store Finder v3.6 allows attackers to access the administration panel.CVE-2023-41516.1The Store Locator WordPress plugin before 1.4.13 does not sanitise and escape an invalid nonce before outputting it back in an AJAX response CVE-2023-415196.1Student Attendance Management System v1 was discovered to contain a cross-site scripting (XSS) vulnerability via the sessionName parameter a CVE-2023-41527.5Frauscher Sensortechnik GmbH FDS101 for FAdC/FAdCi v1.4.24 and all previous versions are vulnerable to a path traversal vulnerability of the