CVE-2023-5922

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The Royal Elementor Addons and Templates WordPress plugin before 1.3.81 does not ensure that users accessing posts via an AJAX action (and REST endpoint, currently disabled in the plugin) have the right to do so, allowing unauthenticated users to access arbitrary draft, private and password protected posts/pages content

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected software

No affected versions have been published.

Timeline

Published
Jan 16, 2024
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-59237.5A vulnerability classified as critical has been found in Campcodes Simple Student Information System 1.0. This affects an unknown part of thCVE-2023-59247.5A vulnerability classified as critical was found in Campcodes Simple Student Information System 1.0. This vulnerability affects unknown codeCVE-2023-59257.5A vulnerability, which was classified as critical, has been found in Campcodes Simple Student Information System 1.0. This issue affects somCVE-2023-59267.5A vulnerability, which was classified as critical, was found in Campcodes Simple Student Information System 1.0. Affected is an unknown funcCVE-2023-59277.5A vulnerability has been found in Campcodes Simple Student Information System 1.0 and classified as critical. Affected by this vulnerabilityCVE-2023-59287.5A vulnerability was found in Campcodes Simple Student Information System 1.0 and classified as critical. Affected by this issue is some unknCVE-2023-59297.5A vulnerability was found in Campcodes Simple Student Information System 1.0. It has been classified as critical. This affects an unknown paCVE-2023-59306.1A vulnerability was found in Campcodes Simple Student Information System 1.0. It has been declared as problematic. This vulnerability affectCVE-2023-59318.8The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.6.16 does not validate files to be uploaded, which could allow aCVE-2023-59324.8The Travelpayouts: All Travel Brands in One Place WordPress plugin before 1.1.14 does not sanitise and escape a parameter before outputting CVE-2023-59335.4An issue has been discovered in GitLab CE/EE affecting all versions after 13.7 before 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1CVE-2023-59347.3The Travelpayouts: All Travel Brands in One Place WordPress plugin before 1.1.13 does not have CSRF check in place when importing settings f
CVE-2023-5922: High severity, CVSS 7.5 | Vulnix