CVE-2023-5560

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The WP-UserOnline WordPress plugin before 2.88.3 does not sanitise and escape the X-Forwarded-For header before outputting its content on the page, which allows unauthenticated users to perform Cross-Site Scripting attacks.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
UnknownWP-UserOnline< 2.88.3

References

Timeline

Published
Nov 27, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-55615.3WordPress does not properly restrict which user fields are searchable via the REST API, allowing unauthenticated attackers to discern the emCVE-2023-55626.1An unsafe default configuration in KNIME Analytics Platform before 5.2.0 allows for a cross-site scripting attack. When KNIME Analytics PlatCVE-2023-55637.5The SJA1000 CAN controller driver backend automatically attempt to recover from a bus-off event when built with CONFIG_CAN_AUTO_BUS_OFF_RECOCVE-2023-55644.8Cross-site Scripting (XSS) - Stored in GitHub repository froxlor/froxlor prior to 2.1.0-dev1.CVE-2023-55655.4The Shortcode Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'shortmenu' shortcode in versions up to, and includCVE-2023-55665.4The Simple Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 1.0CVE-2023-55675.4The QR Code Tag plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'qrcodetag' shortcode in versions up to, and includingCVE-2023-55686.5A heap-based Buffer Overflow flaw was discovered in Samba. It could allow a remote, authenticated attacker to exploit this vulnerability to CVE-2023-55707.5Improper Protection for Outbound Error Messages and Alert Signals vulnerability in Inohom Home Manager Gateway allows Account Footprinting. CVE-2023-55717.5Improper Input Validation in GitHub repository vriteio/vrite prior to 0.3.0.CVE-2023-55729.8Server-Side Request Forgery (SSRF) in GitHub repository vriteio/vrite prior to 0.3.0.CVE-2023-55736.5Allocation of Resources Without Limits or Throttling in GitHub repository vriteio/vrite prior to 0.3.0.