CVE-2023-6941

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

The Keap Official Opt-in Forms WordPress plugin through 1.0.11 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example, in multisite setup).

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Unknown	Keap Official Opt-in Forms	<= 1.0.11

References

https://wpscan.com/vulnerability/58f7c9aa-5e59-468f-aba9-b15e7942fd37/Exploit, Third Party Advisory
https://wpscan.com/vulnerability/58f7c9aa-5e59-468f-aba9-b15e7942fd37/Exploit, Third Party Advisory

Timeline

Published: Jan 15, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-69427.5Missing Authentication for Critical Function vulnerability in Mitsubishi Electric Corporation EZSocket versions 3.0 to 5.92, GT Designer3 Ve CVE-2023-69439.8Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Mitsubishi Electric Corporation EZSocket CVE-2023-69445.7A flaw was found in the Red Hat Developer Hub (RHDH). The catalog-import function leaks GitLab access tokens on the frontend when the base64 CVE-2023-69454.8A vulnerability has been found in SourceCodester Online Student Management System 1.0 and classified as problematic. Affected by this vulner CVE-2023-69468.8The Autotitle for WordPress plugin through 1.0.3 does not have CSRF check in place when updating its settings, which could allow attackers t CVE-2023-69477.7The Best WordPress Gallery Plugin – FooGallery plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and includin CVE-2023-69483.0A Buffer Copy without Checking Size of Input issue affecting the v2_sdk_service running on a set of DJI drone devices on the port 10000 coul CVE-2023-69495.2A Missing Authentication for Critical Function issue affecting the HTTP service running on the DJI Mavic Mini 3 Pro on the standard port 80 CVE-2023-69503.0An Improper Input Validation vulnerability affecting the FTP service running on the DJI Mavic Mini 3 Pro could allow an attacker to craft a CVE-2023-69516.6A Use of Weak Credentials vulnerability affecting the Wi-Fi network generated by a set of DJI drones could allow a remote attacker to derive CVE-2023-69535.4The PDF Generator For Fluent Forms – The Contact Form Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the heade CVE-2023-69545.4The Download Manager Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up