CVE-2023-5882

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

The Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro WordPress plugin before 1.8.6 does not check nonce tokens early enough in the request lifecycle, allowing attackers to make logged in users perform unwanted actions leading to remote code execution.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published
Dec 18, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-58846.5The Word Balloon WordPress plugin before 4.20.3 does not protect some of its actions against CSRF attacks, allowing an unauthenticated attacCVE-2023-58856.5The discontinued FFS Colibri product allows a remote user to access files on the system including files containing login credentials for othCVE-2023-58868.8The Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro WordPress plugin before 1.8.6 does not check nonceCVE-2023-58898.2Insufficient Session Expiration in GitHub repository pkp/pkp-lib prior to 3.3.0-16.CVE-2023-58905.4Cross-site Scripting (XSS) - Stored in GitHub repository pkp/pkp-lib prior to 3.3.0-16.CVE-2023-58915.4Cross-site Scripting (XSS) - Reflected in GitHub repository pkp/pkp-lib prior to 3.3.0-16.CVE-2023-58925.4Cross-site Scripting (XSS) - Stored in GitHub repository pkp/pkp-lib prior to 3.3.0-16.CVE-2023-58938.8Cross-Site Request Forgery (CSRF) in GitHub repository pkp/pkp-lib prior to 3.3.0-16.CVE-2023-58945.4Cross-site Scripting (XSS) - Stored in GitHub repository pkp/ojs prior to 3.3.0-16.CVE-2023-58955.4Cross-site Scripting (XSS) - DOM in GitHub repository pkp/pkp-lib prior to 3.3.0-16.CVE-2023-58965.4Cross-site Scripting (XSS) - Stored in GitHub repository pkp/pkp-lib prior to 3.4.0-4.CVE-2023-58978.8Cross-Site Request Forgery (CSRF) in GitHub repository pkp/customLocale prior to 1.2.0-1.
CVE-2023-5882: High severity, CVSS 8.8 | Vulnix