CVE-2023-5715

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

The Website Optimization – Plerdy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's tracking code settings in all versions up to, and including, 1.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Nov 22, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-57169.8ASUS Armoury Crate has a vulnerability in arbitrary file write and allows remote attackers to access or modify arbitrary files by sending spCVE-2023-57177.8A heap out-of-bounds write vulnerability in the Linux kernel's Linux Kernel Performance Events (perf) component can be exploited to achieve CVE-2023-57184.3The Vue.js Devtools extension was found to leak screenshot data back to a malicious web page via the standard `postMessage()` API. By creatiCVE-2023-57199.8The Crimson 3.2 Windows-based configuration tool allows users with administrative access to define new passwords for users and to download tCVE-2023-57207.5A flaw was found in Quarkus, where it does not properly sanitize artifacts created using the Gradle plugin, allowing certain build system inCVE-2023-57214.3It was possible for certain browser prompts and dialogs to be activated or dismissed unintentionally by the user due to an insufficient actiCVE-2023-57225.3Using iterative requests an attacker was able to learn the size of an opaque response, as well as the contents of a server-supplied Vary heaCVE-2023-57235.3An attacker with temporary script access to a site could have set a cookie containing invalid characters using `document.cookie` that could CVE-2023-57247.5Drivers are not always robust to extremely large draw calls and in some cases this scenario could have led to a crash. This vulnerability afCVE-2023-57254.3A malicious installed WebExtension could open arbitrary URLs, which under the right circumstance could be leveraged to collect sensitive useCVE-2023-57264.3A website could have obscured the full screen notification by using the file open dialog. This could have led to user confusion and possibleCVE-2023-57276.5The executable file warning was not presented when downloading .msix, .msixbundle, .appx, and .appxbundle files, which can run commands on a