CVE-2023-6745

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The Custom Field Template plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'cpt' shortcode in all versions up to, and including, 2.6.1 due to insufficient input sanitization and output escaping on user supplied post meta. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Jun 11, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-67465.7An insertion of sensitive information into log file vulnerability was identified in the log files for a GitHub Enterprise Server back-end se CVE-2023-67475.4The Best WordPress Gallery Plugin – FooGallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom attributes i CVE-2023-67484.3The Custom Field Template plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.1 v CVE-2023-67499.8Unchecked length coming from user input in settings shell CVE-2023-67507.5The Clone WordPress plugin before 2.4.3 uses buffer files to store in-progress backup informations, which is stored at a publicly accessible CVE-2023-67516.5The Hostinger plugin for WordPress is vulnerable to unauthorized plugin settings update due to a missing capability check on the function pu CVE-2023-67538.8Path Traversal in GitHub repository mlflow/mlflow prior to 2.9.2.CVE-2023-67557.2A vulnerability was found in DedeBIZ 6.2 and classified as critical. This issue affects some unknown processing of the file /src/admin/conte CVE-2023-67569.8A vulnerability was found in Thecosy IceCMS 2.0.1. It has been classified as problematic. Affected is an unknown function of the file /login CVE-2023-67576.5A vulnerability was found in Thecosy IceCMS 2.0.1. It has been declared as problematic. Affected by this vulnerability is an unknown functio CVE-2023-67584.3A vulnerability was found in Thecosy IceCMS 2.0.1. It has been rated as critical. Affected by this issue is some unknown functionality of th CVE-2023-67597.5A vulnerability classified as problematic has been found in Thecosy IceCMS 2.0.1. This affects an unknown part of the file /WebResource/reso