CVE-2023-6530

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The TJ Shortcodes WordPress plugin through 0.1.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Unknown	TJ Shortcodes	<= 0.1.3

References

https://research.cleantalk.org/cve-2023-6530-tj-shortcodes-stored-xss-poc/Exploit, Third Party Advisory
https://wpscan.com/vulnerability/8e63bf7c-7827-4c4d-b0e3-66354b218bee/Exploit, Third Party Advisory
https://research.cleantalk.org/cve-2023-6530-tj-shortcodes-stored-xss-poc/Exploit, Third Party Advisory
https://wpscan.com/vulnerability/8e63bf7c-7827-4c4d-b0e3-66354b218bee/Exploit, Third Party Advisory

Timeline

Published: Jan 29, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-65317.0A use-after-free flaw was found in the Linux Kernel due to a race problem in the unix garbage collector's deletion of SKB races with unix_st CVE-2023-65328.8The WP Blogs' Planetarium WordPress plugin through 1.0 does not have CSRF check in place when updating its settings, which could allow attac CVE-2023-65336.5Malformed Device Reset Locally Command Class packets can be sent to the controller, causing the controller to assume the end device has left CVE-2023-65347.5In versions of FreeBSD 14.0-RELEASE before 14-RELEASE-p2, FreeBSD 13.2-RELEASE before 13.2-RELEASE-p7 and FreeBSD 12.4-RELEASE before 12.4-R CVE-2023-65357.5A flaw was found in the Linux kernel's NVMe driver. This issue may allow an unauthenticated malicious actor to send a set of crafted TCP pac CVE-2023-65367.5A flaw was found in the Linux kernel's NVMe driver. This issue may allow an unauthenticated malicious actor to send a set of crafted TCP pac CVE-2023-65386.5SMU versions prior to 14.8.7825.01 are susceptible to unintended information disclosure, through URL manipulation. Authenticated users in St CVE-2023-65407.5A vulnerability was reported in the Lenovo Browser Mobile and Lenovo Browser HD Apps for Android that could allow an attacker to craft a pay CVE-2023-65416.1The Allow SVG WordPress plugin before 1.2.0 does not sanitize uploaded SVG files, which could allow users with a role as low as Author to up CVE-2023-65427.1Due to lack of proper authorization checks in Emarsys SDK for Android, an attacker can call a particular activity and can forward himself we CVE-2023-65445.4A flaw was found in the Keycloak package. This issue occurs due to a permissive regular expression hardcoded for filtering which allows host CVE-2023-65454.7The package authelia-bhf included in Beckhoffs TwinCAT/BSD is prone to an open redirect that allows a remote unprivileged attacker to redire