Skip to content
OpenAdvisories

Archive

3 June 2023

Vulnerabilities first published on this day (UTC), newest first.

← May 2023 2023 / June /3 July 2023 →
  1. 177
  2. 2143
  3. 321
  4. 47
  5. 573
  6. 6149
  7. 7185
  8. 840
  9. 9118
  10. 104
  11. 118
  12. 1284
  13. 13187
  14. 14120
  15. 1596
  16. 1679
  17. 179
  18. 1813
  19. 19116
  20. 2064
  21. 2132
  22. 22112
  23. 23192
  24. 245
  25. 2510
  26. 2695
  27. 2777
  28. 28160
  29. 2965
  30. 3083
All Critical High Medium Low Exploited only Public exploit

15 results · Clear filters · Feed

  • Medium 5.9
    CVE-2023-32582

    WordPress Don8 Plugin <= 0.4 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Kyle Maurer Don8 plugin <= 0.4 versions.

    Kyle Maurer Don8
  • Medium 6.4
    CVE-2023-2404

    CRM and Lead Management by vcita <= 2.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

    The CRM and Lead Management by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in versions up to, and including, 2.6.2 due to insufficient input sanitization and output escaping. This makes it possible for aut…

    vcita CRM and Lead Management by vcita Web / CMS
  • Medium 5.4
    CVE-2023-2416

    Online Booking & Scheduling Calendar for WordPress by vcita <= 4.5 - Cross-Site Request Forgery to Account Logout

    The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to Cross-Site Request Forgery due to a missing nonce check on the vcita_logout_callback function in versions up to, and including, 4.5. This makes it possible f…

    vcita Online Booking & Scheduling Calendar for WordPress by vcita Web / CMS
  • Medium 5.4
    CVE-2023-2415

    Online Booking & Scheduling Calendar for WordPress by vcita <= 4.2.10 - Missing Authorization to Account Logout

    The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the vcita_logout_callback function in versions up to, and including, 4.2.10. This make…

    vcita Online Booking & Scheduling Calendar for WordPress by vcita Web / CMS
  • Medium 6.1
    CVE-2023-2301

    Contact Form Builder by vcita <= 4.10.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting

    The Contact Form Builder by vcita plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.10.3. This is due to missing nonce validation on the ls_parse_vcita_callback function. This makes it possible for unauthenti…

    eyale-vc Contact Form Builder by vcita Web / CMS
  • Medium 5.3
    CVE-2023-2299

    Online Booking & Scheduling Calendar for WordPress by vcita <= 4.4.2 - Missing Authorization on REST-API

    The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to unauthorized medication of data via the /wp-json/vcita-wordpress/v1/actions/auth REST-API endpoint in versions up to, and including, 4.4.2 due to a missing c…

    vcita Online Booking & Scheduling Calendar for WordPress by vcita Web / CMS
  • Medium 6.4
    CVE-2023-2302

    Contact Form and Calls To Action by vcita <= 2.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

    The Contact Form and Calls To Action by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in versions up to, and including, 2.6.4 due to insufficient input sanitization and output escaping. This makes it possibl…

    vcita Contact Form and Calls To Action by vcita Web / CMS
  • Medium 6.1
    CVE-2023-2303

    Contact Form and Calls To Action by vcita <= 4.10.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting

    The Contact Form and Calls To Action by vcita plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.10.5. This is due to missing nonce validation in the vcita-callback.php file. This makes it possible for unauthe…

    eyale-vc Contact Form Builder by vcita Web / CMS
  • Medium 6.1
    CVE-2023-2407

    Event Registration Calendar By vcita <= 1.3.1 & Online Payments – Get Paid with PayPal, Square & Stripe <= 3.10.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting

    The Event Registration Calendar By vcita plugin, versions up to and including 3.10.0, and Online Payments – Get Paid with PayPal, Square & Stripe plugin, for WordPress are vulnerable to Cross-Site Request Forgery. This is due to missing nonce validation in th…

    vcita Online Payments – Get Paid with PayPal, Square & Stripe Event Registration Calendar By vcita
  • Medium 6.4
    CVE-2023-2300

    Contact Form Builder by vcita <= 4.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

    The Contact Form Builder by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in versions up to, and including, 4.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authen…

    eyale-vc Contact Form Builder by vcita Web / CMS
  • Medium 6.4
    CVE-2023-2406

    Event Registration Calendar By vcita <= 1.3.1 & Online Payments – Get Paid with PayPal, Square & Stripe <= 3.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

    The Event Registration Calendar By vcita plugin, versions up to and including 3.9.1, and Online Payments – Get Paid with PayPal, Square & Stripe plugin, for WordPress are vulnerable to Stored Cross-Site Scripting via the 'email' parameter in versions up to, a…

    vcita Online Payments – Get Paid with PayPal, Square & Stripe Event Registration Calendar By vcita
  • Medium 6.1
    CVE-2023-2405

    CRM and Lead Management by vcita <= 2.7.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting

    The CRM and Lead Management by vcita plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.7.0. This is due to missing nonce validation in the vcita-callback.php file. This makes it possible for unauthenticated a…

    vcita CRM and Lead Management by vcita Web / CMS
  • Medium 4.3
    CVE-2023-0584

    VK Blocks <= 1.57.0.5 - Authenticated(Contributor+) Settings Update

    The VK Blocks plugin for WordPress is vulnerable to improper authorization via the REST 'update_options' function in versions up to, and including, 1.57.0.5. This allows authenticated attackers, with contributor-level permissions or above, to change the 'vk_f…

    Vektor VK Blocks Web / CMS
  • Medium 4.3
    CVE-2023-0583

    VK Blocks <= 1.57.0.5 - Authenticated(Contributor+) Settings Update

    The VK Blocks plugin for WordPress is vulnerable to improper authorization via the REST 'update_vk_blocks_options' function in versions up to, and including, 1.57.0.5. This allows authenticated attackers, with contributor-level permissions or above, to change…

    Vektor VK Blocks Web / CMS
  • Medium 6.1
    CVE-2023-3083

    Cross-site Scripting (XSS) - Stored in nilsteampassnet/teampass

    Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.9.

    nilsteampassnet nilsteampassnet/teampass nilsteampassnet/teampass Packagist