CVE-2023-5934

HighCVSS 7.3/10Last modified Jun 17, 2026

Description

The Travelpayouts: All Travel Brands in One Place WordPress plugin before 1.1.13 does not have CSRF check in place when importing settings from the v1, which could allow attackers to make a logged in admin update some settings via a CSRF attack

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
Unknown	Travelpayouts: All Travel Brands in One Place	< 1.1.13

References

https://wpscan.com/vulnerability/2a45cdba-df41-457e-bff9-2d6d89776dd0/Exploit, Third Party Advisory

Timeline

Published: May 15, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2023

CVE-2023-59357.4When configuring Arc (e.g. during the first setup), a local web interface is provided to ease the configuration process. Such web interface CVE-2023-59367.8On Unix systems (Linux, MacOS), Arc uses a temporary file with unsafe privileges. By tampering with such file, a malicious local user in CVE-2023-59373.8On Windows systems, the Arc configuration files resulted to be world-readable. This can lead to information disclosure by local attackers CVE-2023-59388.0Multiple functions use archives without properly validating the filenames therein, rendering the application vulnerable to path traversal vi CVE-2023-59397.2The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.6.16 loads the contents of the import file in an unsafe manner, CVE-2023-59404.8The WP Not Login Hide (WPNLH) WordPress plugin through 1.0 does not sanitise and escape some of its settings, which could allow high privile CVE-2023-59419.8In versions of FreeBSD 12.4-RELEASE prior to 12.4-RELEASE-p7 and FreeBSD 13.2-RELEASE prior to 13.2-RELEASE-p5 the __sflush() stdio function CVE-2023-59425.4The Medialist WordPress plugin before 1.4.1 does not validate and escape some of its shortcode attributes before outputting them back in a p CVE-2023-59434.8The Wp-Adv-Quiz WordPress plugin before 1.0.3 does not sanitise and escape some of its settings, which could allow high privilege users such CVE-2023-59447.8Delta Electronics DOPSoft is vulnerable to a stack-based buffer overflow, which may allow for arbitrary code execution if an attacker can le CVE-2023-59455.4The video carousel slider with lightbox plugin for WordPress is vulnerable to Cross-Site Request Forgery in version 1.0. This is due to miss CVE-2023-59466.1The Digirisk plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'current_group_id' parameter in version 6.0.0.0 du