CVE-2023-5529

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

The Advanced Page Visit Counter WordPress plugin before 8.0.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: May 15, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2023

CVE-2023-55304.8The Ninja Forms Contact Form WordPress plugin before 3.6.34 does not sanitize and escape its label fields, which could allow high privilege CVE-2023-55314.3The Thumbnail Slider With Lightbox plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0. T CVE-2023-55324.3The ImageMapper plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.6. This is due to mis CVE-2023-55339.8The AI ChatBot plugin for WordPress is vulnerable to unauthorized use of AJAX actions due to missing capability checks on the corresponding CVE-2023-55345.4The AI ChatBot plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.8.9 and 4.9.2. This is d CVE-2023-55357.8Use After Free in GitHub repository vim/vim prior to v9.0.2010.CVE-2023-55366.4A feature in LXD (LP#1829071), affects the default configuration of Ubuntu Server which allows privileged users in the lxd group to escalate CVE-2023-55374.3The Delete Usermeta plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.2. This is due to CVE-2023-55386.1The MpOperationLogs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the IP Request Headers in versions up to, and incl CVE-2023-55398.8A remote code execution risk was identified in the Lesson activity. By default this was only available to teachers and managers.CVE-2023-55408.8A remote code execution risk was identified in the IMSCP activity. By default this was only available to teachers and managers.CVE-2023-55416.1The CSV grade import method contained an XSS risk for users importing the spreadsheet, if it contained unsafe content.