CVE-2023-0420

Published: Apr 24, 2023Modified: Jun 17, 2026

4.8

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Exploitability: 1.7 / Impact: 2.7

Source: NVD

Description

The Custom Post Type and Taxonomy GUI Manager WordPress plugin through 1.1 does not have CSRF, and is lacking sanitising as well as escaping in some parameters, allowing attackers to make a logged in admin put Stored Cross-Site Scripting payloads via CSRF

Affected (1)

Products: Custom Post Type And Taxonomy Gui Manager Project: Custom Post Type And Taxonomy Gui Manager

Custom Post Type And Taxonomy Gui Manager Project

1 product

Custom Post Type And Taxonomy Gui Manager

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Custom Post Type And Taxonomy Gui Manager Project Custom Post Type And Taxonomy Gui Manager	Up to 1.1

References (2)

https://wpscan.com/vulnerability/266e417f-ece7-4ff5-a724-4d9c8e2f3faa

Source: contact@wpscan.com

ExploitThird Party Advisory

https://wpscan.com/vulnerability/266e417f-ece7-4ff5-a724-4d9c8e2f3faa

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

Timeline

No history available yet.