CVE-2023-1469

The WP Express Checkout plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘pec_coupon[code]’ parameter in versions up to, and including, 2.2.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with administrator-level access to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Note: This can potentially be exploited by lower-privileged users if the `Admin Dashboard Access Permission` setting it set for those users to access the dashboard.

• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2879453%40wp-express-checkout&new=2879453%40wp-express-checkout&sfp_email=&sfph_mail=Patch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/b35ee801-f04d-4b22-8238-053b02a6ee0c?source=cveThird Party Advisory
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2879453%40wp-express-checkout&new=2879453%40wp-express-checkout&sfp_email=&sfph_mail=Patch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/b35ee801-f04d-4b22-8238-053b02a6ee0c?source=cveThird Party Advisory

Published

Mar 17, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-1463Authorization Bypass Through User-Controlled Key in GitHub r…5.4
• CVE-2023-1464A vulnerability, which was classified as critical, was found…9.8
• CVE-2023-1465The WP EasyPay WordPress plugin before 4.1 does not escape s…6.1
• CVE-2023-1466A vulnerability was found in SourceCodester Student Study Ce…6.3
• CVE-2023-1467A vulnerability classified as critical has been found in Sou…9.8
• CVE-2023-1468A vulnerability classified as critical was found in SourceCo…9.8
• CVE-2023-1470The eCommerce Product Catalog plugin for WordPress is vulner…4.8
• CVE-2023-1471The WP Popup Banners plugin for WordPress is vulnerable to S…6.5
• CVE-2023-1472The RapidLoad Power-Up for Autoptimize plugin for WordPress …6.3
• CVE-2023-1473The Slider, Gallery, and Carousel by MetaSlider WordPress pl…6.1
• CVE-2023-1474A vulnerability classified as critical was found in SourceCo…9.8
• CVE-2023-1475A vulnerability, which was classified as critical, has been …9.8