CVE-2023-7229

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

The illi Link Party! WordPress plugin through 1.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
Unknown	illi Link Party!	<= 1.0

References

https://wpscan.com/vulnerability/d16f6ba0-a47d-413f-a6d4-058910441009/Exploit, Third Party Advisory

Timeline

Published: May 15, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2023

CVE-2023-72306.1The illi Link Party! WordPress plugin through 1.0 does not sanitize and escape some parameters, which could allow users with a role as low a CVE-2023-72317.3The illi Link Party! WordPress plugin through 1.0 lacks proper access controls, allowing unauthenticated visitors to delete links.CVE-2023-72325.3The Backup and Restore WordPress WordPress plugin through 1.45 does not protect some log files containing sensitive information such as sit CVE-2023-72334.8The GigPress WordPress plugin through 2.3.29 does not sanitise and escape some of its settings, which could allow high privilege users such CVE-2023-72345.3OPCUAServerToolkit will write a log message once an OPC UA client has successfully connected containing the client's self-defined descriptio CVE-2023-72358.4The OpenVPN GUI installer before version 2.6.9 did not set the proper access control restrictions to the installation directory of OpenVPN b CVE-2023-72364.7The Backup Bolt WordPress plugin through 1.3.0 is vulnerable to Information Exposure via the unprotected access of debug logs. This makes it CVE-2023-72377.5Lantronix XPort sends weakly encoded credentials within web request headers.CVE-2023-72386.1A XSS payload can be uploaded as a DICOM study and when a user tries to view the infected study inside the Osimis WebViewer the XSS vulnerab CVE-2023-72397.5The WP Dashboard Notes WordPress plugin before 1.0.11 does not validate that the user has access to the post_id parameter in its wpdn_update CVE-2023-72405.8An improper authorization level has been detected in the login panel. It may lead to unauthenticated Server Side Request Forgery and allows CVE-2023-72417.9Privilege Escalation in WRSA.EXE in Webroot Antivirus 8.0.1X- 9.0.35.12 on Windows64 bit and 32 bit allows malicious software to abuse WRS