{"id":"CVE-2023-7246","aliases":["EUVD-2023-59427","GHSA-qmw9-5q6h-hjxj"],"status":"published","title":"System Dashboard \u003c 2.8.10 - XSS via Header Injection","description":"The System Dashboard WordPress plugin before 2.8.10 does not sanitize and escape some parameters, which could allow administrators in multisite WordPress configurations to perform Cross-Site Scripting attacks","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00807,"percentile":0.5708,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2024-03-20T05:00:02Z","modified":"2026-06-17T06:52:24Z","exploits":[{"source":"nuclei","id":"CVE-2023-7246","title":"System Dashboard \u003c 2.8.10 - Cross-Site Scripting","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-7246.yaml"}],"products":[{"vendor":"bowo","product":"system_dashboard"},{"vendor":"qriouslad","product":"system dashboard"},{"vendor":"unknown","product":"system dashboard"}],"references":[{"url":"https://wpscan.com/vulnerability/7413d5ec-10a7-4cb8-ac1c-4ef554751518/","tags":["exploit","vdb-entry","technical-description","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-7246"},{"url":"https://wpscan.com/vulnerability/7413d5ec-10a7-4cb8-ac1c-4ef554751518"},{"url":"https://github.com/advisories/GHSA-qmw9-5q6h-hjxj"}],"sources":{"cve":[{"id":"CVE-2023-7246","title":"System Dashboard \u003c 2.8.10 - XSS via Header Injection","description":"The System Dashboard WordPress plugin before 2.8.10 does not sanitize and escape some parameters, which could allow administrators in multisite WordPress configurations to perform Cross-Site Scripting attacks","status":"published","published":"2024-03-20T05:00:02.302Z","modified":"2024-08-05T15:32:24.317Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"updated_at":"2026-11-02T14:35:33.794347Z"}],"euvd":[{"id":"EUVD-2023-59427","description":"The System Dashboard WordPress plugin before 2.8.10 does not sanitize and escape some parameters, which could allow administrators in multisite WordPress configurations to perform Cross-Site Scripting attacks","status":"published","published":"2024-03-20T05:00:02Z","modified":"2024-08-05T15:32:24Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T02:39:12.564822Z"}],"ghsa":[{"id":"GHSA-qmw9-5q6h-hjxj","title":"The System Dashboard WordPress plugin before 2.8.10 does not sanitize and escape some parameters,...","description":"The System Dashboard WordPress plugin before 2.8.10 does not sanitize and escape some parameters, which could allow administrators in multisite WordPress configurations to perform Cross-Site Scripting attacks","status":"published","published":"2024-03-20T15:32:28Z","modified":"2025-05-05T21:32:22Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:02:07.964163Z"}],"nvd":[{"id":"CVE-2023-7246","description":"The System Dashboard WordPress plugin before 2.8.10 does not sanitize and escape some parameters, which could allow administrators in multisite WordPress configurations to perform Cross-Site Scripting attacks","status":"published","published":"2024-03-20T05:15:45.277Z","modified":"2026-06-17T06:52:24.077Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:09:10.192572Z"}]}}