Skip to content
OpenAdvisories

Archive

May 2023

Vulnerabilities first published in this month (UTC), newest first.

← April 2023 2023 / May June 2023 →
  1. 139
  2. 281
  3. 378
  4. 487
  5. 542
  6. 69
  7. 74
  8. 8185
  9. 9252
  10. 10210
  11. 11101
  12. 1290
  13. 13 
  14. 1411
  15. 15147
  16. 1695
  17. 1757
  18. 1891
  19. 1927
  20. 2023
  21. 217
  22. 2284
  23. 2399
  24. 2486
  25. 2578
  26. 2688
  27. 2724
  28. 2834
  29. 2934
  30. 30151
  31. 31120
All Critical High Medium Low Exploited only Public exploit

2,434 results · Feed

  • Medium 4.3
    CVE-2022-45815

    WordPress GDPR Compliance & Cookie Consent Plugin <= 1.2 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in StylemixThemes GDPR Compliance & Cookie Consent plugin <= 1.2 versions.

    StylemixThemes GDPR Compliance & Cookie Consent
  • Medium 5.4
    CVE-2022-45371

    WordPress ShopEngine Plugin <= 4.1.1 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Wpmet ShopEngine plugin <= 4.1.1 versions.

    Wpmet ShopEngine
  • Medium 5.4
    CVE-2022-38716

    WordPress Motors – Car Dealer & Classified Ads Plugin <= 1.4.4 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in StylemixThemes Motors – Car Dealer, Classifieds & Listing plugin <= 1.4.4 versions.

    StylemixThemes Motors – Car Dealer, Classifieds & Listing
  • Medium 5.4
    CVE-2022-38356

    WordPress Pearl Plugin <= 1.3.4 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in StylemixThemes WordPress Header Builder Plugin – Pearl plugin <= 1.3.4 versions.

    StylemixThemes WordPress Header Builder Plugin – Pearl Web / CMS
  • Medium 5.4
    CVE-2022-43490

    WordPress Stream Plugin <= 3.9.2 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in XWP Stream plugin <= 3.9.2 versions.

    xwp Stream
  • Medium 6.3
    CVE-2022-41987

    WordPress BadgeOS Plugin <= 3.7.1.6 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in LearningTimes BadgeOS plugin <= 3.7.1.6 versions.

    LearningTimes BadgeOS
  • Medium 4.3
    CVE-2022-45367

    WordPress Custom Order Numbers for WooCommerce Plugin <= 1.4.0 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Tyche Softwares Custom Order Numbers for WooCommerce plugin <= 1.4.0 versions.

    Tyche Softwares Custom Order Numbers for WooCommerce Web / CMS
  • Medium 4.3
    CVE-2022-47177

    WordPress WP EasyPay Plugin <= 4.1 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in WP Easy Pay WP EasyPay – Square for WordPress plugin <= 4.1 versions.

    WP Easy Pay WP EasyPay – Square for WordPress Web / CMS
  • Medium 4.3
    CVE-2023-30484

    WordPress Enable Accessibility Plugin <= 1.4 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in uPress Enable Accessibility plugin <= 1.4 versions.

    uPress Enable Accessibility
  • Medium 4.3
    CVE-2022-47149

    WordPress Shortlinks by Pretty Links Plugin <= 3.4.0 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Pretty Links plugin <= 3.4.0 versions.

    Pretty Links Pretty Links
  • Medium 4.3
    CVE-2022-47165

    WordPress CoSchedule Plugin <= 3.3.8 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in CoSchedule plugin <= 3.3.8 versions.

    CoSchedule CoSchedule
  • Medium 4.3
    CVE-2022-47161

    WordPress Health Check & Troubleshooting Plugin <= 1.5.1 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in The WordPress.Org community Health Check & Troubleshooting plugin <= 1.5.1 versions.

    The WordPress.org community Health Check & Troubleshooting
  • Medium 4.3
    CVE-2022-41635

    WordPress Advanced Shipment Tracking for WooCommerce Plugin <= 3.5.2 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Zorem Advanced Shipment Tracking for WooCommerce plugin <= 3.5.2 versions.

    zorem Advanced Shipment Tracking for WooCommerce Web / CMS
  • Medium 5.4
    CVE-2022-46800

    WordPress LiteSpeed Cache Plugin <= 5.3 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in LiteSpeed Technologies LiteSpeed Cache plugin <= 5.3 versions.

    LiteSpeed Technologies LiteSpeed Cache
  • Medium 4.3
    CVE-2022-46812

    WordPress Thank You Page Customizer for WooCommerce – Increase Your Sales Plugin <= 1.0.13 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in VillaTheme Thank You Page Customizer for WooCommerce – Increase Your Sales plugin <= 1.0.13 versions.

    villatheme Thank You Page Customizer for WooCommerce – Increase Your Sales Web / CMS
  • Medium 4.3
    CVE-2022-46865

    WordPress Bulk Resize Media Plugin <= 1.1 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Marty Thornley Bulk Resize Media plugin <= 1.1 versions.

    Marty Thornley Bulk Resize Media
  • Critical 9.8
    CVE-2023-2887

    User Authentication Bypass in CBOT's Chatbot

    Authentication Bypass by Spoofing vulnerability in CBOT Chatbot allows Authentication Bypass. This issue affects Chatbot: before Core: v4.0.3.4 Panel: v4.0.3.7.

    CBOT Chatbot
  • Medium 4.3
    CVE-2022-46866

    WordPress Import External Images Plugin <= 1.4 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Marty Thornley Import External Images plugin <= 1.4 versions.

    Marty Thornley Import External Images
  • Medium 4.3
    CVE-2023-2886

    Cross-Site WebSocket Hijacking in CBOT's Chatbot

    Missing Origin Validation in WebSockets vulnerability in CBOT Chatbot allows Content Spoofing Via Application API Manipulation. This issue affects Chatbot: before Core: v4.0.3.4 Panel: v4.0.3.7.

    CBOT Chatbot
  • High 8.1
    CVE-2023-2885

    Channel Accessible by Non-Endpoint in CBOT's Chatbot

    Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability in CBOT Chatbot allows Adversary in the Middle (AiTM). This issue affects Chatbot: before Core: v4.0.3.4 Panel: v4.0.3.7.

    CBOT Chatbot
  • Medium 4.3
    CVE-2022-47164

    WordPress Event Manager for WooCommerce Plugin <= 3.7.7 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in MagePeople Team Event Manager and Tickets Selling Plugin for WooCommerce plugin <= 3.7.7 versions.

    MagePeople Team Event Manager and Tickets Selling Plugin for WooCommerce Web / CMS
  • Critical 9.8
    CVE-2023-2884

    Insecure Randomness in CBOT's Chatbot

    Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG), Use of Insufficiently Random Values vulnerability in CBOT Chatbot allows Signature Spoofing by Key Recreation. This issue affects Chatbot: before Core: v4.0.3.4 Panel: v4.0.3.7.

    CBOT Chatbot
  • High 8.8
    CVE-2023-2883

    IDOR in CBOT's Chatbot

    Authorization Bypass Through User-Controlled Key vulnerability in CBOT Chatbot allows Authentication Abuse, Authentication Bypass. This issue affects Chatbot: before Core: v4.0.3.4 Panel: v4.0.3.7.

    CBOT Chatbot
  • Critical 9.8
    CVE-2023-2882

    Privilege Escalation in CBOT's Chatbot

    Generation of Incorrect Security Tokens vulnerability in CBOT Chatbot allows Token Impersonation, Privilege Abuse. This issue affects Chatbot: before Core: v4.0.3.4 Panel: v4.0.3.7.

    CBOT Chatbot
  • Medium 4.3
    CVE-2022-47159

    WordPress Logaster Logo Generator Plugin <= 1.3 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Logaster Logaster Logo Generator plugin <= 1.3 versions.

    Logaster Logaster Logo Generator
  • Medium 4.3
    CVE-2022-47138

    WordPress LOGIN AND REGISTRATION ATTEMPTS LIMIT Plugin <= 2.1 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in German Krutov LOGIN AND REGISTRATION ATTEMPTS LIMIT plugin <= 2.1 versions.

    German Krutov LOGIN AND REGISTRATION ATTEMPTS LIMIT
  • Medium 5.4
    CVE-2022-47139

    WordPress WP Basic Elements Plugin <= 5.2.15 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Damir Calusic WP Basic Elements plugin <= 5.2.15 versions.

    Damir Calusic WP Basic Elements
  • Medium 4.3
    CVE-2022-47135

    WordPress Chronoforms Plugin <= 7.0.9 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in chronoengine.Com Chronoforms plugin <= 7.0.9 versions.

    chronoengine.com Chronoforms
  • Medium 6.1
    CVE-2022-46907 Public exploit

    Apache JSPWiki: XSS Injection points in several plugins

    A carefully crafted request on several JSPWiki plugins could trigger an XSS vulnerability on Apache JSPWiki, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. Apache JSPWiki users…

    Apache Software Foundation Apache JSPWiki org.apache.jspwiki:jspwiki-main org.apache.jspwiki:jspwiki-war Maven
  • Critical 9.8
    CVE-2023-2732 Public exploit Scanner template EPSS 67%

    MStore API <= 3.9.2 - Authentication Bypass

    The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.9.2. This is due to insufficient verification on the user being supplied during the add listing REST API request through the plugin. This makes it p…

    inspireui MStore API – Create Native Android & iOS Apps On The Cloud Android iOS Web / CMS
  • Critical 9.8
    CVE-2023-2733

    MStore API <= 3.9.0 - Authentication Bypass

    The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.9.0. This is due to insufficient verification on the user being supplied during the coupon redemption REST API request through the plugin. This make…

    inspireui MStore API – Create Native Android & iOS Apps On The Cloud Android iOS Web / CMS
  • Critical 9.8
    CVE-2023-2734 Scanner template

    MStore API <= 3.9.1 - Authentication Bypass

    The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.9.1. This is due to insufficient verification on the user being supplied during the cart sync from mobile REST API request through the plugin. This …

    inspireui MStore API – Create Native Android & iOS Apps On The Cloud Android iOS Web / CMS
  • High 7.8
    CVE-2023-0950

    Array Index UnderFlow in Calc Formula Parsing

    Improper Validation of Array Index vulnerability in the spreadsheet component of The Document Foundation LibreOffice allows an attacker to craft a spreadsheet document that will cause an array index underflow when loaded. In the affected versions of LibreOffi…

    The Document Foundation LibreOffice libreoffice libreoffice Debian Ubuntu
  • Medium 5.4
    CVE-2023-33750

    A stored cross-site scripting (XSS) vulnerability in mipjz v5.0.5 allows attackers to execute arbitrary web scripts or …

  • Critical 9.8
    CVE-2023-33279

    In the Store Commander scfixmyprestashop module through 2023-05-09 for PrestaShop, sensitive SQL calls can be executed …

  • Medium 5.4
    CVE-2023-33751

    A stored cross-site scripting (XSS) vulnerability in mipjz v5.0.5 allows attackers to execute arbitrary web scripts or …

  • High 7.5
    CVE-2023-33355

    IceCMS v1.0.0 has Insecure Permissions. There is unauthorized access to the API, resulting in the disclosure of sensiti…

  • Critical 9.8
    CVE-2023-33280

    In the Store Commander scquickaccounting module for PrestaShop through 3.7.3, multiple sensitive SQL calls can be execu…

  • High 7.5
    CVE-2023-33263

    In WFTPD 3.25, usernames and password hashes are stored in an openly viewable wftpd.ini configuration file within the W…

  • Critical 9.8
    CVE-2023-33278

    In the Store Commander scexportcustomers module for PrestaShop through 3.6.1, sensitive SQL calls can be executed with …