CVE-2023-6164 - CVE House
Back to Database
Status published Low CVE-2023-6164

MainWP Dashboard <= 4.5.1.2 - Authenticated(Administrator+) CSS Injection

Vulnerability Description

The MainWP Dashboard – WordPress Manager for Multiple Websites Maintenance plugin for WordPress is vulnerable to CSS Injection via the ‘newColor’ parameter in all versions up to, and including, 4.5.1.2 due to insufficient input sanitization. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary CSS values into the site tags.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-6164

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Hüseyin TINTAŞ

References

More from mainwp

View All →
CVE-2024-7492
MainWP Child Reports <= 2.2 - Cross-Site Request Forgery to Arbitrary Options Update
High 8.8
CVE-2024-1642
MainWP Dashboard <= 4.6.0.1 - Cross-Site Request Forgery via posting_bulk
Medium 4.3
CVE-2024-10783
MainWP Child <= 5.3.3 - Missing Authorization to Unauthenticated Privilege Escalation
High 8.1
CVE-2023-3132
MainWP Child <= 4.4.1.1 - Information Disclosure via Back-Up Files
Medium 5.9
CVE-2016-15041
MainWP Dashboard – The Private WordPress Manager for Multiple Website Maintenance Plugin <= 3.1.2 - Stored Cross-Site Scripting
High 7.2

Affected Vendor

Affected Software

MainWP Dashboard: Self-hosted WordPress Management for Agencies
Vulnerable Versions:
0

Timeline

Official Publish: November 22nd, 2023
Last Modified: April 8th, 2026
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N

Weaknesses (CWE)

CWE-74

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1059 Command and Scripting Interpreter
Execution
T1562 Impair Defenses
Defense Evasion
T1213 Data from Information Repositories
Collection