CVE-2023-5507

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The ImageMapper plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'imagemap' shortcode in versions up to, and including, 1.2.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Nov 7, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-55095.4The myStickymenu WordPress plugin before 2.6.5 does not adequately authorize some ajax calls, allowing any logged-in user to perform the act CVE-2023-55118.8Cross-Site Request Forgery (CSRF) in GitHub repository snipe/snipe-it prior to v.6.2.3.CVE-2023-55125.7An issue has been discovered in GitLab CE/EE affecting all versions from 16.3 before 16.4.4, all versions starting from 16.5 before 16.5.4, CVE-2023-55145.3The response messages received from the eSOMS report generation using certain parameter queries with full file path can be abused for enumer CVE-2023-55155.3The responses for web queries with certain parameters disclose internal path of resources. This information can be used to learn internal st CVE-2023-55165.3Poorly constructed webap requests and URI components with special characters trigger unhandled errors and exceptions, disclosing information CVE-2023-55177.5A flaw in query-handling code can cause `named` to exit prematurely with an assertion failure when: - `nxdomain-redirect <domain>;` is co CVE-2023-55194.3The EventPrime WordPress plugin before 3.2.0 does not have CSRF checks when creating bookings, which could allow attackers to make logged in CVE-2023-55207.7Out-of-bounds Read in GitHub repository gpac/gpac prior to 2.2.2.CVE-2023-55219.8Incorrect Authorization in GitHub repository tiann/kernelsu prior to v0.6.9.CVE-2023-55224.3Mattermost Mobile fails to limit the maximum number of Markdown elements in a post allowing an attacker to send a post with hundreds of emoj CVE-2023-55237.8Execution of downloaded content flaw in M-Files Web Companion before release version 23.10 and LTS Service Release Versions before 23.8 LTS