How severe is CVE-2023-1069?

CVE-2023-1069 has a CVSS 3.x base score of 5.4, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and user interaction. Impact on confidentiality is low, integrity low, and availability none.

Is CVE-2023-1069 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (42nd percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2023-1069?

CVE-2023-1069 primarily affects Really-simple-plugins Complianz. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2023-1069?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2023-1069 published?

CVE-2023-1069 was published on 2023-03-27 and last updated on 2026-06-17.

CVE-2023-1069

CVE-2023-1069 is a medium-severity vulnerability in Really-simple-plugins Complianz with a CVSS 3.x base score of 5.4. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.

Key facts

Severity: Medium (CVSS 3.x base score 5.4)
EPSS exploit prediction: 1% (42nd percentile)
Actively exploited: Not listed in CISA KEV
Affected product: Really-simple-plugins Complianz
Published: 2023-03-27
Last modified: 2026-06-17

Description

The Complianz WordPress plugin before 6.4.2, Complianz Premium WordPress plugin before 6.4.2 do not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks

Frequently asked questions

What is CVE-2023-1069?: The Complianz WordPress plugin before 6.4.2, Complianz Premium WordPress plugin before 6.4.2 do not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
How severe is CVE-2023-1069?: CVE-2023-1069 has a CVSS 3.x base score of 5.4, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and user interaction. Impact on confidentiality is low, integrity low, and availability none.
Is CVE-2023-1069 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (42nd percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2023-1069?: CVE-2023-1069 primarily affects Really-simple-plugins Complianz. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2023-1069?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2023-1069 published?: CVE-2023-1069 was published on 2023-03-27 and last updated on 2026-06-17.

References

https://wpscan.com/vulnerability/caacc50c-822e-46e9-bc0b-681349fd0dda

Affected products (2)

cpe:2.3:a:really-simple-plugins:complianz:*:*:*:*:-:wordpress:*:*
cpe:2.3:a:really-simple-plugins:complianz:*:*:*:*:premium:wordpress:*:*

More vulnerabilities in Really-simple-plugins Complianz

CVE-2022-3494 — High (CVSS 8.8): The Complianz WordPress plugin before 6.3.4, and Complianz Premium WordPress plugin before 6.3.6 allow a translators to…
CVE-2023-33333 — High (CVSS 7.1): Cross-Site Request Forgery (CSRF) vulnerability in Really Simple Plugins Complianz, Really Simple Plugins Complianz…
CVE-2023-34030 — Medium (CVSS 6.5): Cross-Site Request Forgery (CSRF) vulnerability in Really Simple Plugins Complianz, Really Simple Plugins Complianz…
CVE-2022-0193 — Medium (CVSS 6.1): The Complianz WordPress plugin before 6.0.0 does not escape the s parameter before outputting it back in an attribute…
CVE-2023-6498 — Medium (CVSS 4.4): The Complianz – GDPR/CCPA Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin…
CVE-2024-1592 — Medium (CVSS 4.3): The Complianz – GDPR/CCPA Cookie Consent plugin for WordPress is vulnerable to Cross-Site Request Forgery in all…

All CVEs affecting Really-simple-plugins Complianz →