CVE-2023-5531

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

The Thumbnail Slider With Lightbox plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on the delete functionality. This makes it possible for unauthenticated attackers to delete image lightboxes via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published: Oct 12, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-55324.3The ImageMapper plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.6. This is due to mis CVE-2023-55339.8The AI ChatBot plugin for WordPress is vulnerable to unauthorized use of AJAX actions due to missing capability checks on the corresponding CVE-2023-55345.4The AI ChatBot plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.8.9 and 4.9.2. This is d CVE-2023-55357.8Use After Free in GitHub repository vim/vim prior to v9.0.2010.CVE-2023-55366.4A feature in LXD (LP#1829071), affects the default configuration of Ubuntu Server which allows privileged users in the lxd group to escalate CVE-2023-55374.3The Delete Usermeta plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.2. This is due to CVE-2023-55386.1The MpOperationLogs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the IP Request Headers in versions up to, and incl CVE-2023-55398.8A remote code execution risk was identified in the Lesson activity. By default this was only available to teachers and managers.CVE-2023-55408.8A remote code execution risk was identified in the IMSCP activity. By default this was only available to teachers and managers.CVE-2023-55416.1The CSV grade import method contained an XSS risk for users importing the spreadsheet, if it contained unsafe content.CVE-2023-55424.3Students in "Only see own membership" groups could see other students in the group, which should be hidden.CVE-2023-55433.3When duplicating a BigBlueButton activity, the original meeting ID was also duplicated instead of using a new ID for the new activity. This