CVE-2023-4971

Published: Oct 16, 2023Modified: Jun 17, 2026

7.2

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.2 / Impact: 5.9

Source: NVD

Description

The Weaver Xtreme Theme Support WordPress plugin before 6.3.1 unserialises the content of an imported file, which could lead to PHP object injections issues when a high privilege user import a malicious file and a suitable gadget chain is present on the blog.

Affected (1)

Products: Weavertheme: Weaver Xtreme Theme Support

1 product

Weaver Xtreme Theme Support

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Weavertheme Weaver Xtreme Theme Support	Before 6.3.1

Related CWEs

Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

References (2)

https://wpscan.com/vulnerability/421194e1-6c3f-4972-8f3c-de1b9d2bcb13

Source: contact@wpscan.com

ExploitThird Party Advisory

https://wpscan.com/vulnerability/421194e1-6c3f-4972-8f3c-de1b9d2bcb13

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

Timeline

No history available yet.