Security Advisory

CVE-2023-0993

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2023-06-09 05:33:19

Last updated 2026-04-08 16:58:11

Assigner Wordfence

CVSS score 4.3

State PUBLISHED

Description

The Shield Security plugin for WordPress is vulnerable to Missing Authorization on the 'theme-plugin-file' AJAX action in versions up to, and including, 17.0.17. This allows authenticated attackers to add arbitrary audit log entries indicating that a theme or plugin has been edited, and is also a vector for Cross-Site Scripting via CVE-2023-0992.

← Browse all CVEs View on cve.org ↗