blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2023-3492

MEDIUM 6.8 CVSS 3.1
Published
August 7, 2023
Last modified
June 17, 2026
NVD status
Modified
Reported by
contact@wpscan.com
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

Description

The WP Shopping Pages WordPress plugin through 1.14 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.

Affected products and versions

  • Unknown WP Shopping Pages — Up to and including 1.14
  • cmscommander wp_shopping_pages — Up to and including 1.14

References

  • wpscan.com https://wpscan.com/vulnerability/01b9b1c2-439e-44df-bf01-026cb13d7d40 Exploit, Third Party Advisory
  • nvd.nist.gov Official NVD record