WordPress Plugin Vulnerabilities

Code Embed < 2.3.7 - Authenticated(Contributor+) Denial of Service

Description

The Code Embed plugin for WordPress is vulnerable to Denial of Service in all versions up to, and including, 2.3.6. This makes it possible for authenticated attackers, with contributor access and above, to disrupt access to the site.

Affects Plugins

Plugin icon
simple-embed-code
Fixed in 2.3.7

References

CVE
CVE-2023-49837
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/2ef2ded1-dd56-4c33-98dc-d4c69e66568f

Miscellaneous

Original Researcher
Universe
Verified
No
WPVDB ID
6b5c9c49-c52b-448f-b5fd-74683476b6e4

Timeline

Publicly Published
2023-12-05 (about 5 months ago)
Added
2023-12-09 (about 5 months ago)
Last Updated
2024-01-22 (about 3 months ago)

Other

Published
Title
Published
2014-11-20
Title
WordPress <= 4.0 - Long Password Denial of Service (DoS)
Published
2022-07-11
Title
GiveWP < 2.21.3 - DoS via CSRF
Published
2022-01-17
Title
Popup | Custom Popup Builder < 1.3.1 - Unauthenticated Denial of Service
Published
2020-10-29
Title
WordPress < 5.5.2 - Unauthenticated DoS Attack to RCE
Published
2018-02-05
Title
WordPress <= 4.9.4 - Application Denial of Service (DoS) (unpatched)