CVE-2023-6165

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

The Restrict Usernames Emails Characters WordPress plugin before 3.1.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Jan 29, 2024
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-61666.1The Quiz Maker WordPress plugin before 6.4.9.5 does not escape generated URLs before outputting them in attributes, leading to Reflected CroCVE-2023-61739.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TeoSOFT Software TeoBASE allows SQL InCVE-2023-61746.5SSH dissector crash in Wireshark 4.0.0 to 4.0.10 allows denial of service via packet injection or crafted capture fileCVE-2023-61757.8NetScreen file parser crash in Wireshark 4.0.0 to 4.0.10 and 3.6.0 to 3.6.18 allows denial of service via crafted capture fileCVE-2023-61764.7A null pointer dereference flaw was found in the Linux kernel API for the cryptographic algorithm scatterwalk functionality. This issue occuCVE-2023-61786.5An arbitrary file write vulnerability exists where an authenticated attacker with privileges on the managing application could alter Nessus CVE-2023-61797.8Honeywell ProWatch, 4.5, including all Service Pack versions, contain a Vulnerability in Application Server's executable folder(s). A(n) attCVE-2023-61805.3The tokio-boring library in version 4.0.0 is affected by a memory leak issue that can lead to excessive resource consumption and potential DCVE-2023-61819.8An oversight in BCB handling of reboot reason that allows for persistent code executionCVE-2023-61847.2Cross SiteScripting vulnerability in Citrix Session Recording allows attacker to perform Cross Site ScriptingCVE-2023-61858.8Improper Input Validation vulnerability in GStreamer integration of The Document Foundation LibreOffice allows an attacker to execute arbitrCVE-2023-61868.8Insufficient macro permission validation of The Document Foundation LibreOffice allows an attacker to execute built-in macros without warnin