CVE-2023-5229

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

The E2Pdf WordPress plugin before 1.20.20 does not sanitize and escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Unknown	E2Pdf	< 1.20.20

References

https://wpscan.com/vulnerability/fb6ce636-9e0d-4c5c-bb95-dde1d2581245Exploit, Third Party Advisory
https://wpscan.com/vulnerability/fb6ce636-9e0d-4c5c-bb95-dde1d2581245Exploit, Third Party Advisory

Timeline

Published: Oct 31, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-522908.1In streampark-console the list pages(e.g: application pages), users can sort page by field. This sort field is sent from the front-end to th CVE-2023-522914.7In streampark, the project module integrates Maven's compilation capabilities. The input parameter validation is not strict, allowing attack CVE-2023-522925.4IBM Sterling File Gateway 6.0.0.0 through 6.1.2.5 and 6.2.0.0 through 6.2.0.3 is vulnerable to stored cross-site scripting. This vulnerabili CVE-2023-522965.3IBM DB2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 is vulnerable to denial of service when querying a specific UDF built CVE-2023-52305.4The TM WooCommerce Compare & Wishlist plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'tm_woo_wishlist_table' shortcod CVE-2023-523027.5Nullptr in paddle.nextafter in PaddlePaddle before 2.6.0. This flaw can cause a runtime crash and a denial of service.CVE-2023-523037.5Nullptr in paddle.put_along_axis in PaddlePaddle before 2.6.0. This flaw can cause a runtime crash and a denial of service.CVE-2023-523049.8Stack overflow in paddle.searchsorted in PaddlePaddle before 2.6.0. This flaw can lead to a denial of service, or even more damage.CVE-2023-523057.5FPE in paddle.topk in PaddlePaddle before 2.6.0. This flaw can cause a runtime crash and a denial of service.CVE-2023-523067.5FPE in paddle.lerp in PaddlePaddle before 2.6.0. This flaw can cause a runtime crash and a denial of service.CVE-2023-523079.8Stack overflow in paddle.linalg.lu_unpack in PaddlePaddle before 2.6.0. This flaw can lead to a denial of service, or even more damage.CVE-2023-523087.5FPE in paddle.amin in PaddlePaddle before 2.6.0. This flaw can cause a runtime crash and a denial of service.