CVE-2023-2708

The Video Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘search_term’ parameter in versions up to, and including, 1.0.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. CVE-2023-32597 may be a duplicate of this.

• CWE-79
• CWE-79

• https://patchstack.com/database/vulnerability/video-slider-with-thumbnails/wordpress-video-gallery-plugin-1-0-10-cross-site-scripting-xss-vulnerability
• https://plugins.trac.wordpress.org/browser/video-slider-with-thumbnails/tags/1.0.10/video-slider-with-thumbnails.php#L1103Issue Tracking
• https://plugins.trac.wordpress.org/browser/video-slider-with-thumbnails/tags/1.0.11/video-slider-with-thumbnails.php#L1105Issue Tracking
• https://www.wordfence.com/threat-intel/vulnerabilities/id/8cfbad9f-61ba-4216-9078-c1e7e809899a?source=cveThird Party Advisory
• https://plugins.trac.wordpress.org/browser/video-slider-with-thumbnails/tags/1.0.10/video-slider-with-thumbnails.php#L1103Issue Tracking
• https://plugins.trac.wordpress.org/browser/video-slider-with-thumbnails/tags/1.0.11/video-slider-with-thumbnails.php#L1105Issue Tracking
• https://www.wordfence.com/threat-intel/vulnerabilities/id/8cfbad9f-61ba-4216-9078-c1e7e809899a?source=cveThird Party Advisory

Published

May 16, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-27074BP Monitoring Management System v1.0 was discovered to conta…9.8
• CVE-2023-27075A cross-site scripting vulnerability (XSS) in the component …5.4
• CVE-2023-27076Command injection vulnerability found in Tenda G103 v.1.0.0.…9.8
• CVE-2023-27077Stack Overflow vulnerability found in 360 D901 allows a remo…7.5
• CVE-2023-27078A command injection issue was found in TP-Link MR3020 v.1_15…9.8
• CVE-2023-27079Command Injection vulnerability found in Tenda G103 v.1.0.05…7.5
• CVE-2023-27082Cross Site Scripting (XSS) vulnerability in /admin.php in Pl…4.8
• CVE-2023-27083An issue discovered in /admin.php in Pluck CMS 4.7.15 throug…7.2
• CVE-2023-27084Permissions vulnerability found in isoftforce Dreamer CMS v.…5.3
• CVE-2023-27087Permissions vulnerabiltiy found in Xuxueli xxl-job v2.2.0, v…7.5
• CVE-2023-27088feiqu-opensource Background Vertical authorization vulnerabi…8.8
• CVE-2023-27089Cross Site Scripting vulnerability found in Ehuacui BBS allo…8.2