CVE-2023-7083

MEDIUM

Voting Record < 2.0 - Cross-Site Request Forgery and Stored Cross-Site Scripting

Title source: llm
STIX 2.1

Description

The Voting Record WordPress plugin through 2.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack

References (2)

Core 2
Core References
Third Party Advisory exploit vdb-entry technical-description
https://wpscan.com/vulnerability/ba77704a-32a1-494b-b2c0-e1c2a3f98adc/

Scores

CVSS v3 5.4
EPSS 0.0021
EPSS Percentile 10.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-352
Status published
Products (1)
davidjmiller/voting_record < 2.0
Published Jan 16, 2024
Tracked Since Feb 18, 2026