CVE-2023-5860

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

The Icons Font Loader plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the upload function in all versions up to, and including, 1.1.2. This makes it possible for authenticated attackers, with administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

No affected versions have been published.

Timeline

Published
Nov 2, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-58614.8Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 2.0.CVE-2023-58623.3Missing Authorization in GitHub repository hamza417/inure prior to Build95.CVE-2023-58636.1Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.2.2.CVE-2023-58644.8Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.2.1.CVE-2023-58659.8Insufficient Session Expiration in GitHub repository thorsten/phpmyfaq prior to 3.2.2.CVE-2023-58665.7Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository thorsten/phpmyfaq prior to 3.2.1.CVE-2023-58675.4Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.2.2.CVE-2023-58684.3A memory disclosure vulnerability was found in PostgreSQL that allows remote users to access sensitive information by exploiting certain aggCVE-2023-58698.8A flaw was found in PostgreSQL that allows authenticated database users to execute arbitrary code through missing overflow checks during SQLCVE-2023-58704.4A flaw was found in PostgreSQL involving the pg_cancel_backend role that signals background workers, including the logical replication launcCVE-2023-58715.3A flaw was found in libnbd, due to a malicious Network Block Device (NBD), a protocol for accessing Block Devices such as hard disks over a CVE-2023-58724.3In Wago Smart Designer in versions up to 2.33.1 a low privileged remote attacker may enumerate projects and usernames through iterative requ