CVE-2023-5615

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The Skype Legacy Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'skype-status' shortcode in all versions up to, and including, 3.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Oct 20, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-56164.9In Ubuntu, gnome-control-center did not properly reflect SSH remote login status when the system was configured to use systemd socket activaCVE-2023-56175.3Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.1.0.0 and 9.3.0.6, including 9.5.x and 8.3.x, display the version ofCVE-2023-56185.4The Modern Footnotes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode in versions up to, and incCVE-2023-56205.4The Web Push Notifications WordPress plugin before 4.35.0 does not prevent visitors on the site from changing some of the plugin options, soCVE-2023-56214.8The Thumbnail Slider With Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Title field in versions uCVE-2023-56228.8Under certain conditions, Nessus Network Monitor could allow a low privileged user to escalate privileges to NT AUTHORITY\SYSTEM on Windows CVE-2023-56237.8NNM failed to properly set ACLs on its installation directory, which could allow a low privileged user to run arbitrary code with SYSTEM priCVE-2023-56247.2Under certain conditions, Nessus Network Monitor was found to not properly enforce input validation. This could allow an admin user to alterCVE-2023-56257.5A regression was introduced in the Red Hat build of python-eventlet due to a change in the patch application strategy, resulting in a patch CVE-2023-56268.8Cross-Site Request Forgery (CSRF) in GitHub repository pkp/ojs prior to 3.3.0-16.CVE-2023-56277.5A vulnerability has been identified in NPort 6000 Series, making the authentication mechanism vulnerable. This vulnerability arises from theCVE-2023-56296.1A CWE-601:URL Redirection to Untrusted Site (‘Open Redirect’) vulnerability exists that could cause disclosure of information through phishi