CVE-2023-5048

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The WDContactFormBuilder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Contact_Form_Builder' shortcode in versions up to, and including, 1.0.72 due to insufficient input sanitization and output escaping on 'id' user supplied attribute. This makes it possible for authenticated attackers with contributor level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Nov 22, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-504817.5An issue was discovered in blinksocks version 3.3.8, allows remote attackers to obtain sensitive information via weak encryption algorithms CVE-2023-504889.8An issue in Blurams Lumi Security Camera (A31C) v23.0406.435.4120 allows attackers to execute arbitrary code.CVE-2023-50495.4The Giveaways and Contests by RafflePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'rafflepress' and 'raffl CVE-2023-504956.5NCurse v6.4-20230418 was discovered to contain a segmentation fault via the component _nc_wrap_entry().CVE-2023-50505.4The Leaflet Map plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 3.3.0 due CVE-2023-50515.4The CallRail Phone Call Tracking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'callrail_form' shortcode in vers CVE-2023-50526.3vulnerability in Uniform Server Zero, version 10.2.5, consisting of an XSS through the /us_extra/phpinfo.php page. This vulnerability could CVE-2023-50539.8Hospital management system version 378c157 allows to bypass authentication. This is possible because the application is vulnerable to SQLI.CVE-2023-50545.3The Super Store Finder plugin for WordPress is vulnerable to unauthenticated arbitrary email creation and relay in versions up to, and inclu CVE-2023-50559.8Possible variant of CVE-2021-3434 in function le_ecred_reconf_req.CVE-2023-505505.4layui up to v2.74 was discovered to contain a cross-site scripting (XSS) vulnerability via the data-content parameter.CVE-2023-505595.5An issue was discovered in XiangShan v2.1, allows local attackers to obtain sensitive information via the L1D cache.