Skip to content
OpenAdvisories

Archive

30 August 2023

Vulnerabilities first published on this day (UTC), newest first.

← July 2023 2023 / August /30 September 2023 →
  1. 184
  2. 256
  3. 3150
  4. 457
  5. 526
  6. 619
  7. 7115
  8. 8254
  9. 9102
  10. 10133
  11. 11155
  12. 123
  13. 1329
  14. 14136
  15. 1595
  16. 16104
  17. 1779
  18. 1859
  19. 197
  20. 2014
  21. 2163
  22. 22191
  23. 2361
  24. 2465
  25. 2586
  26. 266
  27. 2713
  28. 2877
  29. 2952
  30. 30119
  31. 31104
All Critical High Medium Low Exploited only Public exploit

119 results · Feed

  • Unscored —
    CVE-2022-1601

    User Access Manager < 2.2.18 - IP Spoofing

    The User Access Manager WordPress plugin before 2.2.18 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDR, which makes it possible for attackers to access restricted content in certain situations.

    Web / CMS
  • Unscored —
    CVE-2023-1982

    Front Editor <= 4.0.4 - Admin+ Stored XSS

    The Front Editor WordPress plugin through 4.0.4 does not sanitize and escape some of its form settings, which could allow high-privilege users to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example i…

    Web / CMS
  • Medium 4.3
    CVE-2023-4023

    All Users Messenger <= 1.24 - Subscriber+ Message Deletion via IDOR

    The All Users Messenger WordPress plugin through 1.24 does not prevent non-administrator users from deleting messages from the all-users messenger.

    Web / CMS
  • Medium 4.8
    CVE-2023-4109

    Ninja Forms < 3.6.26 - Admin+ Stored HTML Injection

    The Ninja Forms WordPress Ninja Forms Contact Form WordPress plugin before 3.6.26 was affected by a HTML Injection security vulnerability.

    Web / CMS
  • Medium 6.5
    CVE-2023-4013

    GDPR Cookie Compliance < 4.12.5 - License Update/Deactivation via CSRF

    The GDPR Cookie Compliance (CCPA, DSGVO, Cookie Consent) WordPress plugin before 4.12.5 does not have proper CSRF checks when managing its license, which could allow attackers to make logged in admins update and deactivate the plugin's license via CSRF attacks

    Web / CMS
  • Medium 6.1
    CVE-2023-3992

    PostX - Gutenberg Post Grid Blocks < 3.0.6 - Reflected Cross-Site Scripting

    The PostX WordPress plugin before 3.0.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

    Web / CMS
  • Medium 5.4
    CVE-2023-4035

    Simple Blog Card < 1.31 - Contributor+ Stored XSS via Shortcode

    The Simple Blog Card WordPress plugin before 1.31 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Sto…

    Web / CMS
  • Medium 4.3
    CVE-2023-4036

    Simple Blog Card < 1.32 - Subscriber+ Arbitrary Post Access

    The Simple Blog Card WordPress plugin before 1.32 does not ensure that posts to be displayed via a shortcode are public, allowing any authenticated users, such as subscriber, to retrieve arbitrary post title and their content such as draft, private and passwo…

    Web / CMS
  • Medium 6.5
    CVE-2023-3720

    Upload Media By URL < 1.0.8 - Stored XSS via CSRF

    The Upload Media By URL WordPress plugin before 1.0.8 does not have CSRF check when uploading files, which could allow attackers to make logged in admins upload files (including HTML containing JS code for users with the unfiltered_html capability) on their b…

    Web / CMS
  • Medium 4.8
    CVE-2023-3501

    FormCraft < 1.2.7 - Admin+ Stored XSS

    The FormCraft WordPress plugin before 1.2.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for exam…

    Web / CMS
  • Unscored —
    CVE-2023-3356

    Subscribers Text Counter < 1.7.1 - Settings Update via CSRF to Stored XSS

    The Subscribers Text Counter WordPress plugin before 1.7.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack, which also lead to Stored Cross-Site Scripting due to…

    Web / CMS
  • High 7.1
    CVE-2023-34032

    WordPress bbPress Toolkit Plugin <= 1.0.12 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Pascal Casier bbPress Toolkit plugin <= 1.0.12 versions.

    Pascal Casier bbPress Toolkit
  • Medium 5.9
    CVE-2023-34172

    WordPress WordPress Social Login Plugin <= 3.0.4 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Miled WordPress Social Login plugin <= 3.0.4 versions.

    miled WordPress Social Login Web / CMS
  • Medium 5.9
    CVE-2023-34173

    WordPress Yandex Metrica Counter Plugin <= 1.4.3 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Alexander Semikashev Yandex Metrica Counter plugin <= 1.4.3 versions.

    Alexander Semikashev Yandex Metrica Counter
  • High 7.1
    CVE-2023-34174

    WordPress BBS e-Popup Plugin <= 2.4.5 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in BBS e-Theme BBS e-Popup plugin <= 2.4.5 versions.

    BBS e-Theme BBS e-Popup
  • High 7.1
    CVE-2023-34180

    WordPress Google Fonts For WordPress Plugin <= 3.0.0 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in KAPlugins Google Fonts For WordPress plugin <= 3.0.0 versions.

    KAPlugins Google Fonts For WordPress Web / CMS
  • High 7.1
    CVE-2023-34175

    WordPress Login Configurator Plugin <= 2.1 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in GrandSlambert Login Configurator plugin <= 2.1 versions.

    GrandSlambert Login Configurator
  • High 7.1
    CVE-2023-34176

    WordPress Chilexpress woo oficial Plugin <= 1.2.9 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Chilexpress Chilexpress woo oficial plugin <= 1.2.9 versions.

    Chilexpress Chilexpress woo oficial
  • High 7.1
    CVE-2023-34184

    WordPress Woocommerce Order address Print Plugin <= 3.2 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Bhavik Patel Woocommerce Order address Print plugin <= 3.2 versions.

    Bhavik Patel Woocommerce Order address Print Web / CMS
  • Medium 5.9
    CVE-2023-34183

    WordPress Unite Gallery Lite Plugin <= 1.7.61 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Valiano Unite Gallery Lite plugin <= 1.7.61 versions.

    Valiano Unite Gallery Lite
  • Medium 5.9
    CVE-2023-34187

    WordPress Call Now Icon Animate Plugin <= 0.1.0 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Alan Tien Call Now Icon Animate plugin <= 0.1.0 versions.

    Alan Tien Call Now Icon Animate
  • Medium 5.9
    CVE-2023-27426

    WordPress NotifyVisitors Plugin <= 1.0 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Notifyvisitors NotifyVisitors plugin <= 1.0 versions.

    Notifyvisitors NotifyVisitors
  • Medium 5.9
    CVE-2023-33929

    WordPress Easy Admin Menu Plugin <= 1.3 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Joaquín Ruiz Easy Admin Menu plugin <= 1.3 versions.

    Joaquín Ruiz Easy Admin Menu
  • High 7.1
    CVE-2023-33320

    WordPress WP-Hijri Plugin <= 1.5.1 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Mohammad I. Okfie WP-Hijri plugin <= 1.5.1 versions.

    Mohammad I. Okfie WP-Hijri
  • High 7.1
    CVE-2023-33325

    WordPress Leyka Plugin <= 3.30.1 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Teplitsa of social technologies Leyka plugin <= 3.30.1 versions.

    Teplitsa of social technologies Leyka
  • High 7.1
    CVE-2023-33317

    WordPress WooCommerce Warranty Requests Plugin <= 2.1.6 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WooCommerce Returns and Warranty Requests plugin <= 2.1.6 versions.

    woocommerce Returns and Warranty Requests
  • Medium 5.9
    CVE-2023-33210

    WordPress nuajik CDN Plugin <= 0.1.0 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in nuajik plugin <= 0.1.0 versions.

    nuajik nuajik
  • Medium 5.9
    CVE-2023-25462

    WordPress WP htaccess Control Plugin <= 3.5.1 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WP htaccess Control plugin <= 3.5.1 versions.

  • Medium 5.9
    CVE-2023-33208

    WordPress Cookie Monster Plugin <= 1.51 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in gsmith Cookie Monster plugin <= 1.51 versions.

    gsmith Cookie Monster
  • Low 2.4
    CVE-2023-4624

    Server-Side Request Forgery (SSRF) in bookstackapp/bookstack

    Server-Side Request Forgery (SSRF) in GitHub repository bookstackapp/bookstack prior to v23.08.

    BookStackApp bookstackapp/bookstack
  • Medium 5.9
    CVE-2023-32962

    WordPress WishSuite Plugin <= 1.3.4 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in HasTheme WishSuite – Wishlist for WooCommerce plugin <= 1.3.4 versions.

    HasTheme WishSuite – Wishlist for WooCommerce Web / CMS
  • High 7.1
    CVE-2023-25019

    WordPress Chaty Plugin <= 3.0.9 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Premio Chaty plugin <= 3.0.9 versions

    Premio Chaty
  • High 7.1
    CVE-2023-32597

    WordPress Video Gallery Plugin <= 1.0.10 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in I Thirteen Web Solution Video Gallery plugin <= 1.0.10 versions.

    I Thirteen Web Solution Video Gallery
  • Medium 6.5
    CVE-2023-32746

    WordPress WooCommerce Brands Plugin <= 1.6.45 is vulnerable to Cross Site Scripting (XSS)

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in WooCommerce WooCommerce Brands plugin <= 1.6.45 versions.

    woocommerce WooCommerce Brands Web / CMS
  • Medium 6.5
    CVE-2023-32793

    WordPress WooCommerce Pre-Orders Plugin <= 2.0.0 is vulnerable to Cross Site Scripting (XSS)

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in WooCommerce WooCommerce Pre-Orders plugin <= 2.0.0 versions.

    woocommerce WooCommerce Pre-Orders Web / CMS
  • High 7.1
    CVE-2023-32802

    WordPress WooCommerce Pre-Orders Plugin <= 1.9.0 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WooCommerce WooCommerce Pre-Orders plugin <= 1.9.0 versions.

    woocommerce WooCommerce Pre-Orders Web / CMS
  • Medium 4.3
    CVE-2023-4600

    The AffiliateWP for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on t…

    AffiliateWP AffiliateWP
  • High 7.1
    CVE-2023-32801

    WordPress WooCommerce Composite Products Plugin <= 8.7.5 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WooCommerce Composite Products plugin <= 8.7.5 versions.

    woocommerce Composite Products
  • High 7.1
    CVE-2023-32742

    WordPress WP SMS Plugin <= 6.1.4 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in VeronaLabs WP SMS plugin <= 6.1.4 versions.

    VeronaLabs WP SMS
  • Medium 5.8
    CVE-2023-32740

    WordPress Custom 404 Pro Plugin <= 3.8.1 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Kunal Nagar Custom 404 Pro plugin <= 3.8.1 versions.

    Kunal Nagar Custom 404 Pro