CVE-2023-0958

MEDIUM Year: 2023
CVSS v3 Score
6.5
Medium
Weakness Type
NVD-CWE-Other
View all →

Vulnerability Description

Several plugins for WordPress by Inisev are vulnerable to unauthorized installation of plugins due to a missing capability check on the handle_installation function that is called via the inisev_installation AJAX aciton in various versions. This makes it possible for authenticated attackers with minimal permissions, such as subscribers, to install select plugins from Inisev on vulnerable sites. CVE-2023-38514 appears to be a duplicate of this vulnerability.

Related Vulnerabilities

CVE-2006-7031

MEDIUM
CVSS:6.5(Medium)

Microsoft Internet Explorer 6.0.2900 SP2 and earlier allows remote attackers to cause a denial of service (crash) via a table element with a CSS attribute that sets the position, which triggers an "un...

NVD-CWE-Other2006

CVE-2009-3960

MEDIUM
CVSS:6.5(Medium)

Unspecified vulnerability in BlazeDS 3.2 and earlier, as used in LiveCycle 8.0.1, 8.2.1, and 9.0, LiveCycle Data Services 2.5.1, 2.6.1, and 3.0, Flex Data Services 2.0.1, and ColdFusion 7.0.2, 8.0, 8....

NVD-CWE-Other2009

CVE-2012-4818

MEDIUM
CVSS:6.5(Medium)

IBM InfoSphere Information Server 8.1, 8.5, and 8,7 could allow a remote authenticated attacker to obtain sensitive information, caused by improper restrictions on directories. An attacker could explo...

NVD-CWE-Other2012

CVE-2013-7447

MEDIUM
CVSS:6.5(Medium)

Integer overflow in the gdk_cairo_set_source_pixbuf function in gdk/gdkcairo.c in GTK+ before 3.9.8, as used in eom, gnome-photos, eog, gambas3, thunar, pinpoint, and possibly other applications, allo...

NVD-CWE-Other2013

CVE-2014-9908

MEDIUM
CVSS:6.5(Medium)

A Denial of Service vulnerability exists in Google Android 4.4.4, 5.0.2, and 5.1.1, which allows malicious users to block Bluetooh access (Android Bug ID A-28672558).

NVD-CWE-Other2014