First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2023-4151

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The Store Locator WordPress plugin before 1.4.13 does not sanitise and escape an invalid nonce before outputting it back in an AJAX response, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected software

Vendor	Product	Versions
Unknown	Store Locator WordPress	< 1.4.13

References

Timeline

Published: Sep 4, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-415196.1Student Attendance Management System v1 was discovered to contain a cross-site scripting (XSS) vulnerability via the sessionName parameter a CVE-2023-41527.5Frauscher Sensortechnik GmbH FDS101 for FAdC/FAdCi v1.4.24 and all previous versions are vulnerable to a path traversal vulnerability of the CVE-2023-415208.8Student Attendance Management System v1 was discovered to contain multiple SQL injection vulnerabilities in createClassArms.php via the clas CVE-2023-415218.8Student Attendance Management System v1 was discovered to contain multiple SQL injection vulnerabilities in createSessionTerm.php via the id CVE-2023-415228.8Student Attendance Management System v1 was discovered to contain multiple SQL injection vulnerabilities in createStudents.php via the Id, f CVE-2023-415238.8Student Attendance Management System v1 was discovered to contain a SQL injection vulnerability via the emailAddress parameter at createClas CVE-2023-415248.8Student Attendance Management System v1 was discovered to contain a SQL injection vulnerability via the username parameter at index.php.CVE-2023-415259.8Hospital Management System v4 was discovered to contain a SQL injection vulnerability via the patient_contact parameter in patientsearch.php CVE-2023-415269.8Hospital Management System v4 was discovered to contain multiple SQL injection vulnerabilities in func1.php via the username3 and password3 CVE-2023-415279.8Hospital Management System v4 was discovered to contain a SQL injection vulnerability via the password2 parameter in func.php.CVE-2023-415289.8Hospital Management System v4 was discovered to contain multiple SQL injection vulnerabilities in contact.php via the txtname, txtphone, and CVE-2023-415296.1Hospital Management System v4 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities in func2.php via the fname and l

CVE-2023-4151: Medium severity, CVSS 6.1 | Vulnix