blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2023-4823

MEDIUM 5.4 CVSS 3.1
Published
October 31, 2023
Last modified
June 17, 2026
NVD status
Modified
Reported by
contact@wpscan.com
Weakness
CWE-79
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Description

The WP Meta and Date Remover WordPress plugin before 2.2.0 provides an AJAX endpoint for configuring the plugin settings. This endpoint has no capability checks and does not sanitize the user input, which is then later output unescaped. Allowing any authenticated users, such as subscriber change them and perform Stored Cross-Site Scripting.

Affected WordPress components

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

  • Unknown WP Meta and Date Remover — Before 2.2.0
  • prasadkirpekar wp_meta_and_date_remover — Before 2.2.0

References

  • wpscan.com https://wpscan.com/vulnerability/84f53e27-d8d2-4fa3-91f9-447037508d30 Exploit, Third Party Advisory
  • nvd.nist.gov Official NVD record