CVE-2023-6391

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

The Custom User CSS WordPress plugin through 0.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
Unknown	Custom User CSS	<= 0.2

References

https://magos-securitas.com/txt/CVE-2023-6391.txtExploit
https://wpscan.com/vulnerability/4098b18d-6ff3-462c-af05-48adb6599cf3/Exploit, Third Party Advisory
https://magos-securitas.com/txt/CVE-2023-6391.txtExploit
https://wpscan.com/vulnerability/4098b18d-6ff3-462c-af05-48adb6599cf3/Exploit, Third Party Advisory

Timeline

Published: Jan 29, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-63935.3A flaw was found in the Quarkus Cache Runtime. When request processing utilizes a Uni cached using @CacheResult and the cached Uni reuses th CVE-2023-63949.1A flaw was found in Quarkus. This issue occurs when receiving a request over websocket with no role-based permission specified on the GraphQ CVE-2023-63959.8The Mock software contains a vulnerability wherein an attacker could potentially exploit privilege escalation, enabling the execution of arb CVE-2023-63975.3A null pointer dereference vulnerability in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1 and USG FLEX series firmware v CVE-2023-63987.2A post-authentication command injection vulnerability in the file upload binary in Zyxel ATP series firmware versions from 4.32 through 5.37 CVE-2023-63996.5A format string vulnerability in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1, USG FLEX series firmware versions from 4 CVE-2023-64007.4Incorrect Authorization vulnerability in OpenText™ ZENworks Configuration Management (ZCM) allows Unauthorized Use of Device Resources.This CVE-2023-64017.8A vulnerability classified as problematic was found in NotePad++ up to 8.1. Affected by this vulnerability is an unknown functionality of th CVE-2023-64028.8A vulnerability, which was classified as critical, was found in PHPGurukul Nipah Virus Testing Management System 1.0. This affects an unknow CVE-2023-64077.1A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause arbitrary fil CVE-2023-64088.1CWE-924: Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability exists that could cause a de CVE-2023-64097.7CWE-798: Use of Hard-coded Credentials vulnerability exists that could cause unauthorized access to a project file protected with applicatio