CVE-2023-4151

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The Store Locator WordPress plugin before 1.4.13 does not sanitise and escape an invalid nonce before outputting it back in an AJAX response, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected software

No affected versions have been published.

Timeline

Published
Sep 4, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-415196.1Student Attendance Management System v1 was discovered to contain a cross-site scripting (XSS) vulnerability via the sessionName parameter aCVE-2023-41527.5Frauscher Sensortechnik GmbH FDS101 for FAdC/FAdCi v1.4.24 and all previous versions are vulnerable to a path traversal vulnerability of theCVE-2023-415208.8Student Attendance Management System v1 was discovered to contain multiple SQL injection vulnerabilities in createClassArms.php via the clasCVE-2023-415218.8Student Attendance Management System v1 was discovered to contain multiple SQL injection vulnerabilities in createSessionTerm.php via the idCVE-2023-415228.8Student Attendance Management System v1 was discovered to contain multiple SQL injection vulnerabilities in createStudents.php via the Id, fCVE-2023-415238.8Student Attendance Management System v1 was discovered to contain a SQL injection vulnerability via the emailAddress parameter at createClasCVE-2023-415248.8Student Attendance Management System v1 was discovered to contain a SQL injection vulnerability via the username parameter at index.php.CVE-2023-415259.8Hospital Management System v4 was discovered to contain a SQL injection vulnerability via the patient_contact parameter in patientsearch.phpCVE-2023-415269.8Hospital Management System v4 was discovered to contain multiple SQL injection vulnerabilities in func1.php via the username3 and password3 CVE-2023-415279.8Hospital Management System v4 was discovered to contain a SQL injection vulnerability via the password2 parameter in func.php.CVE-2023-415289.8Hospital Management System v4 was discovered to contain multiple SQL injection vulnerabilities in contact.php via the txtname, txtphone, andCVE-2023-415296.1Hospital Management System v4 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities in func2.php via the fname and l