CVE-2023-4281

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

This Activity Log WordPress plugin before 2.8.8 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate its value. This may be used to hide the source of malicious traffic.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Affected software

No affected versions have been published.

Timeline

Published: Sep 25, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-428109.8systeminformation is a System Information Library for Node.JS. Versions 5.0.0 through 5.21.6 have a SSID Command Injection Vulnerability. Th CVE-2023-428115.5aes-gcm is a pure Rust implementation of the AES-GCM. Starting in version 0.10.0 and prior to version 0.10.3, in the AES GCM implementation CVE-2023-428124.3Galaxy is an open-source platform for FAIR data analysis. Prior to version 22.05, Galaxy is vulnerable to server-side request forgery, which CVE-2023-428135.3Kyverno is a policy engine designed for Kubernetes. A security vulnerability was found in Kyverno where an attacker could cause denial of se CVE-2023-428145.3Kyverno is a policy engine designed for Kubernetes. A security vulnerability was found in Kyverno where an attacker could cause denial of se CVE-2023-428155.3Kyverno is a policy engine designed for Kubernetes. A security vulnerability was found in Kyverno where an attacker could cause denial of se CVE-2023-428165.3Kyverno is a policy engine designed for Kubernetes. A security vulnerability was found in Kyverno where an attacker could cause denial of se CVE-2023-428175.4Pimcore admin-ui-classic-bundle provides a Backend UI for Pimcore. The translation value with text including “%s” (from “%suggest%) is parse CVE-2023-428189.8JumpServer is an open source bastion host. When users enable MFA and use a public key for authentication, the Koko SSH server does not verif CVE-2023-428198.8JumpServer is an open source bastion host. Logged-in users can access and modify the contents of any file on the system. A user can use the CVE-2023-42824.3The EmbedPress plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'admin_post_remove' CVE-2023-428208.2JumpServer is an open source bastion host. This vulnerability is due to exposing the random number seed to the API, potentially allowing the