{"id":"CVE-2023-6373","aliases":["EUVD-2023-58614","GHSA-pm8g-4f93-7m8m"],"status":"published","title":"ArtPlacer Widget \u003c 2.20.7 - Editor+ SQLi","description":"The ArtPlacer Widget WordPress plugin before 2.20.7 does not sanitize and escape the \"id\" parameter before submitting the query, leading to a SQLI exploitable by editors and above. Note: Due to the lack of CSRF check, the issue could also be exploited via a CSRF against a logged editor (or above)","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.00415,"percentile":0.36261,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-89"],"published":"2024-01-16T15:57:47Z","modified":"2026-06-17T06:50:37Z","products":[{"vendor":"artplacer","product":"artplacer widget"},{"vendor":"artplacer","product":"artplacer_widget"},{"vendor":"unknown","product":"artplacer widget"}],"references":[{"url":"https://wpscan.com/vulnerability/afc11c92-a7c5-4e55-8f34-f2235438bd1b/","tags":["exploit","vdb-entry","technical-description","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-6373"},{"url":"https://wpscan.com/vulnerability/afc11c92-a7c5-4e55-8f34-f2235438bd1b"},{"url":"https://github.com/advisories/GHSA-pm8g-4f93-7m8m"}],"sources":{"cve":[{"id":"CVE-2023-6373","title":"ArtPlacer Widget \u003c 2.20.7 - Editor+ SQLi","description":"The ArtPlacer Widget WordPress plugin before 2.20.7 does not sanitize and escape the \"id\" parameter before submitting the query, leading to a SQLI exploitable by editors and above. Note: Due to the lack of CSRF check, the issue could also be exploited via a CSRF against a logged editor (or above)","status":"published","published":"2024-01-16T15:57:47.717Z","modified":"2025-06-11T16:38:42.806Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"updated_at":"2026-11-02T14:35:25.469654Z"}],"euvd":[{"id":"EUVD-2023-58614","description":"The ArtPlacer Widget WordPress plugin before 2.20.7 does not sanitize and escape the \"id\" parameter before submitting the query, leading to a SQLI exploitable by editors and above. Note: Due to the lack of CSRF check, the issue could also be exploited via a CSRF against a logged editor (or above)","status":"published","published":"2024-01-16T15:57:47Z","modified":"2025-06-11T16:38:42Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T20:32:24.98161Z"}],"ghsa":[{"id":"GHSA-pm8g-4f93-7m8m","title":"The ArtPlacer Widget WordPress plugin before 2.20.7 does not sanitize and escape the \"id\"...","description":"The ArtPlacer Widget WordPress plugin before 2.20.7 does not sanitize and escape the \"id\" parameter before submitting the query, leading to a SQLI exploitable by editors and above. Note: Due to the lack of CSRF check, the issue could also be exploited via a CSRF against a logged editor (or above)","status":"published","published":"2024-01-16T18:31:10Z","modified":"2025-06-11T18:36:44Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T15:02:42.160981Z"}],"nvd":[{"id":"CVE-2023-6373","description":"The ArtPlacer Widget WordPress plugin before 2.20.7 does not sanitize and escape the \"id\" parameter before submitting the query, leading to a SQLI exploitable by editors and above. Note: Due to the lack of CSRF check, the issue could also be exploited via a CSRF against a logged editor (or above)","status":"published","published":"2024-01-16T16:15:13.693Z","modified":"2026-06-17T06:50:37.883Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:09:01.900189Z"}]}}