CVE-2023-6993

MediumCVSS 6.4/10Last modified Jun 17, 2026

Description

The Custom post types, Custom Fields & more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode and custom post meta in all versions up to, and including, 5.0.4 due to insufficient input sanitization and output escaping on user supplied post meta values. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Metrics

CVSS 3.1 6.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Apr 9, 2024
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2023

CVE-2023-69946.4The List category posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'catlist' shortcode in all versioCVE-2023-69968.8The Display custom fields in the frontend – Post and User Profile Fields plugin for WordPress is vulnerable to Code Injection via the pluginCVE-2023-69987.7Improper privilege management vulnerability in CoolKit Technology eWeLink on Android and iOS allows application lockscreen bypass.This issueCVE-2023-69998.8The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Remote Code Exxecution via shortcode in all versions up to,CVE-2023-70027.2The Backup Migration plugin for WordPress is vulnerable to OS Command Injection in all versions up to, and including, 1.3.9 via the 'url' pCVE-2023-70036.8The AES key utilized in the pairing process between a lock using Sciener firmware and a wireless keypad is not unique, and can be reused to CVE-2023-70046.5The TTLock App does not employ proper verification procedures to ensure that it is communicating with the expected device, allowing for connCVE-2023-70057.5A specially crafted message can be sent to the TTLock App that downgrades the encryption protocol used for communication, and can be utilizeCVE-2023-70069.1The unlockKey character in a lock using Sciener firmware can be brute forced through repeated challenge requests, compromising the locks intCVE-2023-70078.2Sciener server does not validate connection requests from the GatewayG2, allowing an impersonation attack that provides the attacker the unlCVE-2023-70085.9A vulnerability was found in systemd-resolved. This issue may allow systemd-resolved to accept records of DNSSEC-signed domains even when thCVE-2023-70098.2Some Sciener-based locks support plaintext message processing over Bluetooth Low Energy, allowing unencrypted malicious commands to be passe