vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2023-0958

Inisev Plugins (Various Versions) - Missing Authorization on handle_installation function

MEDIUM
6.5
CVSS Score
Published: July 28, 2023 at 04:37 AM UTC
Updated: June 17, 2026 at 05:26 AM UTC
21 products affected across 10 vendorsBackup MigrationSocial Media Share Buttons & Social Sharing IconsClone

Using SSL Mixed Content Fix by steve85b?

Get instant alerts when new vulnerabilities affect SSL Mixed Content Fix - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
MEDIUM6.5
Exploit prediction
EPSS 0.7%
SSVC
No known exploit

Description

Several plugins for WordPress by Inisev are vulnerable to unauthorized installation of plugins due to a missing capability check on the handle_installation function that is called via the inisev_installation AJAX aciton in various versions. This makes it possible for authenticated attackers with minimal permissions, such as subscribers, to install select plugins from Inisev on vulnerable sites. CVE-2023-38514 appears to be a duplicate of this vulnerability.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Backup Migration· Backupblisswordpress-plugin
95%
v < 1.2.8
Affected range stops below 1.2.8, so it looks safe — our inference, not a vendor statement
Clone· Backupblisswordpress-plugin
95%
v < 2.3.8
Affected range stops below 2.3.8, so it looks safe — our inference, not a vendor statement
Duplicate Post· Copy Delete Posts
95%
v < 1.4.0
Affected range stops below 1.4.0, so it looks safe — our inference, not a vendor statement
Enhanced Text Widget· Inisev
95%
v < 1.5.8
Affected range stops below 1.5.8, so it looks safe — our inference, not a vendor statement
Redirection· Inisevwordpress-plugin
95%
v ≤ 1.1.3v < 1.1.4
Affected range stops below 1.1.4, so it looks safe — our inference, not a vendor statement
Rss Redirect & Feedburner Alternative· Inisev
95%
v < 3.8
Affected range stops below 3.8, so it looks safe — our inference, not a vendor statement
SSL Mixed Content Fix· Inisev
95%
v < 3.2.4
Affected range stops below 3.2.4, so it looks safe — our inference, not a vendor statement
Ultimate Posts Widget· Inisev
95%
v < 2.2.5
Affected range stops below 2.2.5, so it looks safe — our inference, not a vendor statement
Pop Up· Mypopups
95%
v < 1.2.0
Affected range stops below 1.2.0, so it looks safe — our inference, not a vendor statement
Social Share Icons & Social Share Buttons· Socialshare
95%
v < 3.5.8
Affected range stops below 3.5.8, so it looks safe — our inference, not a vendor statement

References (23)

Product
Source: [email protected]
https://plugins.trac.wordpress.org/browser/backup-backup/tags/1.2.7/includes/banner/misc.php#L427
Product
Source: [email protected]
https://plugins.trac.wordpress.org/browser/backup-backup/tags/1.2.8/includes/banner/misc.php#L434
Product
Source: [email protected]
https://plugins.trac.wordpress.org/browser/copy-delete-posts/tags/1.3.8/banner/misc.php#L426
Product
Source: [email protected]
https://plugins.trac.wordpress.org/browser/copy-delete-posts/tags/1.4.0/banner/misc.php#L434
Product
Source: [email protected]
https://plugins.trac.wordpress.org/browser/enhanced-text-widget/tags/1.5.6/banner/misc.php#L339
Product
Source: [email protected]
https://plugins.trac.wordpress.org/browser/enhanced-text-widget/tags/1.5.7/banner/misc.php#L351
Product
Source: [email protected]
https://plugins.trac.wordpress.org/browser/feedburner-alternative-and-rss-redirect/tags/3.7/modules/banner/misc.php#L427
Product
Source: [email protected]
https://plugins.trac.wordpress.org/browser/http-https-remover/tags/3.2.3/banner/misc.php#L427

SSVC — Action Prioritization

SSVCNo known exploitNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

6.5MEDIUM[email protected]
Attack Vector
NETWORK
Complexity
LOW
Privileges
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
HIGH
Availability
NONE
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-862

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card