CVE-2023-4521

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The Import XML and RSS Feeds WordPress plugin before 2.1.5 contains a web shell, allowing unauthenticated attackers to perform RCE. The plugin/vendor was not compromised and the files are the result of running a PoC for a previously reported issue (https://wpscan.com/vulnerability/d4220025-2272-4d5f-9703-4b2ac4a51c42) and not deleting the created files when releasing the new version.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected software

No affected versions have been published.

Timeline

Published
Sep 25, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-452104.3Pleasanter 1.3.47.0 and earlier contains an improper access control vulnerability, which may allow a remote authenticated attacker to view tCVE-2023-452136.5A potential attacker with access to the Westermo Lynx device would be able to execute malicious code that could affect the correct functioniCVE-2023-452157.2A stack-based buffer overflow vulnerability exists in the boa setRepeaterSsid functionality of Realtek rtl819x Jungle SDK v3.4.11. A specialCVE-2023-452177.8Improper access control in Intel(R) Power Gadget software for Windows all versions may allow an authenticated user to potentially enable escCVE-2023-452194.4Exposure of Sensitive Information vulnerability exist in an undisclosed BIG-IP TMOS shell (tmsh) command which may allow an authenticated atCVE-2023-45225.3An issue has been discovered in GitLab affecting all versions before 16.2.0. Committing directories containing LF character results in 500 eCVE-2023-452208.8The Android Client application, when enrolled with the define method 1(the user manually inserts the server ip address), use HTTP protocol tCVE-2023-452217.8Improper buffer restrictions in Intel(R) Media SDK all versions may allow an authenticated user to potentially enable escalation of privilegCVE-2023-452225.4An attacker with access to the web application that has the vulnerable software could introduce arbitrary JavaScript by injecting a cross-siCVE-2023-452234.3Mattermost fails to properly validate the "Show Full Name" option in a few endpoints in Mattermost Boards, allowing a member to get the fullCVE-2023-452259.8Zavio CF7500, CF7300, CF7201, CF7501, CB3211, CB3212, CB5220, CB6231, B8520, B8220, and CD321 IP Cameras  with firmware version M2.1.6.05CVE-2023-452267.4The BIG-IP SPK TMM (Traffic Management Module) f5-debug-sidecar and f5-debug-sshd containers contains hardcoded credentials that may allow a
CVE-2023-4521: Critical severity, CVSS 9.8 | Vulnix