CVE-2023-4514

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The Mmm Simple File List WordPress plugin through 2.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Nov 27, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-451404.6The Bastion provides authentication, authorization, traceability and auditability for SSH accesses. SCP and SFTP plugins don't honor group-bCVE-2023-451418.8Fiber is an express inspired web framework written in Go. A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the appliCVE-2023-451427.5OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go. A handler wrapper out of the box adds labels `http.usCVE-2023-451433.5Undici is an HTTP/1.1 client written from scratch for Node.js. Prior to version 5.26.2, Undici already cleared Authorization headers on crosCVE-2023-451449.6com.xwiki.identity-oauth:identity-oauth-ui is a package to aid in building identity and service providers based on OAuth authorizations. WheCVE-2023-451453.6Redis is an in-memory database that persists on disk. On startup, Redis begins listening on a Unix socket before adjusting its permissions tCVE-2023-4514610.0XXL-RPC is a high performance, distributed RPC framework. With it, a TCP server can be set up using the Netty framework and the Hessian seriCVE-2023-451473.1Discourse is an open source community platform. In affected versions any user can create a topic and add arbitrary custom fields to a topic.CVE-2023-451484.3Nextcloud is an open source home cloud server. When Memcached is used as `memcache.distributed` the rate limiting in Nextcloud Server could CVE-2023-451494.3Nextcloud talk is a chat module for the Nextcloud server platform. In affected versions brute force protection of public talk conversation pCVE-2023-45155.5In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate command request size In commit 2b9b8f3b68ed ("ksmbd: vCVE-2023-451504.3Nextcloud calendar is a calendar app for the Nextcloud server platform. Due to missing precondition checks the server was trying to validate
CVE-2023-4514: Medium severity, CVSS 5.4 | Vulnix