CVE-2023-5237

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The Memberlite Shortcodes WordPress plugin before 1.3.9 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Oct 31, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-523709.8Stack overflow vulnerability in the network acceleration module.Successful exploitation of this vulnerability may cause unauthorized file acCVE-2023-523713.5Vulnerability of null references in the motor module.Successful exploitation of this vulnerability may affect availability.CVE-2023-523727.5Vulnerability of input parameter verification in the motor module.Successful exploitation of this vulnerability may affect availability.CVE-2023-523737.5Vulnerability of permission verification in the content sharing pop-up module.Successful exploitation of this vulnerability may cause unauthCVE-2023-523747.5Permission control vulnerability in the package management module.Successful exploitation of this vulnerability may affect service confidentCVE-2023-523757.5Permission control vulnerability in the WindowManagerServices module.Successful exploitation of this vulnerability may affect availability.CVE-2023-523767.5Information management vulnerability in the Gallery module.Successful exploitation of this vulnerability may affect service confidentiality.CVE-2023-523777.4Vulnerability of input data not being verified in the cellular data module.Successful exploitation of this vulnerability may cause out-of-boCVE-2023-523789.8Vulnerability of incorrect service logic in the WindowManagerServices module.Successful exploitation of this vulnerability may cause featureCVE-2023-523797.5Permission control vulnerability in the calendarProvider module.Successful exploitation of this vulnerability may affect service confidentiaCVE-2023-52386.1The EventPrime WordPress plugin before 3.2.0 does not sanitise and escape a parameter before outputting it back in the page, leading to an HCVE-2023-523804.3Vulnerability of improper access control in the email module.Successful exploitation of this vulnerability may affect service confidentialit
CVE-2023-5237: Medium severity, CVSS 5.4 | Vulnix