CVE-2023-6164

—

CVSS 3.1

4.8 medium

EPSS

<1%p33

Published

Nov 22, 2023 (Nov 22, 2023)

Modified

Jun 17, 2026

Description

The MainWP Dashboard – WordPress Manager for Multiple Websites Maintenance plugin for WordPress is vulnerable to CSS Injection via the ‘newColor’ parameter in all versions up to, and including, 4.5.1.2 due to insufficient input sanitization. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary CSS values into the site tags.

Vendors: mainwp
Products: mainwp
Ecosystems: WordPress
Weakness: CWE-74, CWE-79
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (0.4%)

In the news0 stories

No ingested article mentions this CVE yet.