CVE-2023-6165

Restrict Usernames Emails Characters Plugin < 3.1.4 - Admin+ Stored XSS

The Restrict Usernames Emails Characters WordPress plugin before 3.1.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed

Affected

Restrict Usernames Emails Characters

CVSS v3.1 NVD

4.8 MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

EPSS

0.40% chance of exploitation in the next 30 days, 33rd percentile

Published

2024-01-29

Updated

2025-05-29

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/aba62286-9a82-4d5b-9b47-1fddde5da487/

Security advisories

• youki992/youki992.github.io/blob/master/others/apply2.md
• https://wpscan.com/vulnerability/aba62286-9a82-4d5b-9b47-1fddde5da487

References

• CVE Record
• NVD entry