CVE-2023-7084

Voting Record <= 2.0 - Subscriber+ Stored XSS

The Voting Record WordPress plugin through 2.0 is missing sanitisation as well as escaping, which could allow any authenticated users, such as subscriber to perform Stored XSS attacks

Affected

Voting Record

CVSS v3.1 NVD

5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS

0.40% chance of exploitation in the next 30 days, 33rd percentile

Published

2024-01-16

Updated

2025-06-20

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/5e51e239-919b-4e74-a7ee-195f3817f907/

Security advisories

• https://magos-securitas.com/txt/CVE-2023-7084.txt
• https://wpscan.com/vulnerability/5e51e239-919b-4e74-a7ee-195f3817f907

References

• CVE Record
• NVD entry