Skip to content
OpenAdvisories

Archive

27 September 2023

Vulnerabilities first published on this day (UTC), newest first.

← August 2023 2023 / September /27 October 2023 →
  1. 180
  2. 210
  3. 326
  4. 4153
  5. 5123
  6. 6162
  7. 767
  8. 854
  9. 915
  10. 1011
  11. 11118
  12. 12157
  13. 1360
  14. 1467
  15. 1579
  16. 169
  17. 1718
  18. 1855
  19. 1956
  20. 20127
  21. 2158
  22. 2241
  23. 233
  24. 248
  25. 2593
  26. 26166
  27. 27146
  28. 2873
  29. 2983
  30. 3056
All Critical High Medium Low Exploited only Public exploit

146 results · Feed

  • Low 3.5
    CVE-2023-44158

    Sensitive information disclosure due to insufficient token field masking. The following products are affected: Acronis …

    Acronis Acronis Cyber Protect 15
  • Low 3.3
    CVE-2023-44157

    Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cyber Prote…

    Acronis Acronis Cyber Protect 15
  • Medium 4.4
    CVE-2023-44155

    Sensitive information leak through log files. The following products are affected: Acronis Cyber Protect 15 (Linux, Win…

    Acronis Acronis Cyber Protect 15
  • Medium 4.6
    CVE-2023-44154

    Sensitive information disclosure and manipulation due to improper authorization. The following products are affected: A…

    Acronis Acronis Cyber Protect 15
  • Low 2.2
    CVE-2023-44153

    Sensitive information disclosure due to cleartext storage of sensitive information in memory. The following products ar…

    Acronis Acronis Cyber Protect 15
  • Medium 6.1
    CVE-2023-44152

    Sensitive information disclosure and manipulation due to improper authentication. The following products are affected: …

    Acronis Acronis Cyber Protect 15
  • High 7.1
    CVE-2023-41238

    WordPress Social Media & Share Icons Plugin <= 2.8.3 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in UltimatelySocial Social Media Share Buttons & Social Sharing Icons plugin <= 2.8.3 versions.

    UltimatelySocial Social Media Share Buttons & Social Sharing Icons
  • High 7.1
    CVE-2023-41237

    WordPress Arya Multipurpose Pro Theme <= 1.0.8 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Everest Themes Arya Multipurpose Pro theme <= 1.0.8 versions.

    Everest themes Arya Multipurpose Pro
  • High 7.1
    CVE-2023-41236

    WordPress Happy Elementor Addons Pro Plugin <= 2.8.0 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Happy addons Happy Elementor Addons Pro plugin <= 2.8.0 versions.

    Happy addons Happy Elementor Addons Pro
  • High 7.1
    CVE-2023-41235

    WordPress Everest News Pro Theme <= 1.1.7 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Everest Themes Everest News Pro theme <= 1.1.7 versions.

    Everest themes Everest News Pro
  • High 7.1
    CVE-2023-40333

    WordPress Bridge Core Plugin <= 3.0.9 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Qode Interactive Bridge Core plugin <= 3.0.9 versions.

    Qode Interactive Bridge Core
  • High 7.1
    CVE-2023-30493

    WordPress Ultimate Addons for Contact Form 7 Plugin <= 3.2.0 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Themefic Ultimate Addons for Contact Form 7 plugin <= 3.2.0 versions.

    themefic Ultimate Addons for Contact Form 7
  • High 7.1
    CVE-2023-30472

    WordPress URL Shortener by MyThemeShop Plugin <= 1.0.17 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in MyThemeShop URL Shortener by MyThemeShop plugin <= 1.0.17 versions.

    mythemeshop URL Shortener by MyThemeShop
  • Medium 5.0
    CVE-2023-44121

    LG ThinQ Service - Intent redirection with system privilege/LaunchAnyWhere

    The vulnerability is an intent redirection in LG ThinQ Service ("com.lge.lms2") in the "com/lge/lms/things/ui/notification/NotificationManager.java" file. This vulnerability could be exploited by a third-party app installed on an LG device by sending a broadc…

    LG Electronics LG V60 Thin Q 5G(LMV600VM)
  • Critical 9.8
    CVE-2023-35071

    SQLi in MRV Tech's Logging Administration Panel

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in MRV Tech Logging Administration Panel allows SQL Injection. This issue affects Logging Administration Panel: before 20230915 .

    MRV Tech Logging Administration Panel
  • High 7.1
    CVE-2023-30471

    WordPress WP Search Analytics Plugin <= 1.4.7 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Cornel Raiu WP Search Analytics plugin <= 1.4.7 versions.

    Cornel Raiu WP Search Analytics
  • Critical 9.8
    CVE-2023-4737

    SQLi in Hedef Trackings Admin Panel

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Hedef Tracking Admin Panel allows SQL Injection. This issue affects Admin Panel: before 1.2.

    Hedef Tracking Admin Panel
  • Medium 5.9
    CVE-2023-27622

    WordPress GuruWalk Affiliates Plugin <= 1.0.0 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Abel Ruiz GuruWalk Affiliates plugin <= 1.0.0 versions.

    Abel Ruiz GuruWalk Affiliates
  • Medium 6.5
    CVE-2023-27628

    WordPress Sitekit Plugin <= 1.3 is vulnerable to Cross Site Scripting (XSS)

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Webvitaly Sitekit plugin <= 1.3 versions.

    webvitaly Sitekit
  • Medium 5.9
    CVE-2023-25483

    WordPress Easy Coming Soon Plugin <= 2.3 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Ankit Agarwal, Priyanshu Mittal Easy Coming Soon plugin <= 2.3 versions.

    Ankit Agarwal, Priyanshu Mittal Easy Coming Soon
  • High 8.8
    CVE-2023-4934

    IDOR in Usta AYBS

    Authorization Bypass Through User-Controlled Key vulnerability in Usta AYBS allows Authentication Abuse, Authentication Bypass. This issue affects AYBS: before 1.0.3.

    Usta AYBS
  • Medium 5.9
    CVE-2023-40677

    WordPress Vertical Marquee Plugin Plugin <= 7.1 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Gopi Ramasamy Vertical marquee plugin <= 7.1 versions.

    Gopi Ramasamy Vertical marquee plugin
  • Medium 5.9
    CVE-2023-40675

    WordPress Landing Page Builder Plugin <= 1.5.1.2 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in PluginOps Landing Page Builder plugin <= 1.5.1.2 versions.

    PluginOps Landing Page Builder
  • Unscored —
    CVE-2023-43825

    Relative path traversal vulnerability in Shihonkanri Plus Ver9.0.3 and earlier allows a local attacker to execute an ar…

    EKAKIN Shihonkanri Plus
  • Medium 6.5
    CVE-2023-40669

    WordPress Collapse-O-Matic Plugin <= 1.8.5.5 is vulnerable to Cross Site Scripting (XSS)

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in twinpictures, baden03 Collapse-O-Matic plugin <= 1.8.5.5 versions.

    twinpictures, baden03 Collapse-O-Matic
  • Medium 5.9
    CVE-2023-40676

    WordPress Slimstat Analytics Plugin <= 5.0.8 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Jason Crouse, VeronaLabs Slimstat Analytics plugin <= 5.0.8 versions.

    Jason Crouse, VeronaLabs Slimstat Analytics
  • High 7.1
    CVE-2023-40667

    WordPress Simple URLs Plugin <= 117 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Lasso Simple URLs plugin <= 117 versions.

    Lasso Simple URLs
  • Medium 5.9
    CVE-2023-40668

    WordPress Save as PDF plugin by Pdfcrowd Plugin <= 2.16.0 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Pdfcrowd Save as PDF plugin by Pdfcrowd plugin <= 2.16.0 versions.

    pdfcrowd Save as PDF Plugin by PDFCrowd
  • Medium 5.9
    CVE-2023-40665

    WordPress Save as Image plugin by Pdfcrowd Plugin <= 2.16.0 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Pdfcrowd Save as Image plugin by Pdfcrowd plugin <= 2.16.0 versions.

    pdfcrowd Save as Image plugin by Pdfcrowd
  • High 7.1
    CVE-2023-40664

    WordPress Donations Made Easy – Smart Donations Plugin <= 4.0.12 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in RedNao Donations Made Easy – Smart Donations plugin <= 4.0.12 versions.

    RedNao Donations Made Easy – Smart Donations
  • High 7.1
    CVE-2023-40663

    WordPress WP VR Plugin <= 8.3.4 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Rextheme WP VR plugin <= 8.3.4 versions.

    RexTheme WP VR
  • High 7.1
    CVE-2023-40330

    WordPress GD Security Headers Plugin <= 1.6.1 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Milan Petrovic GD Security Headers plugin <= 1.6.1 versions.

    Milan Petrovic GD Security Headers
  • Medium 6.5
    CVE-2023-40605

    WordPress Typing Effect Plugin <= 1.3.6 is vulnerable to Cross Site Scripting (XSS)

    Auth. (contributor) Cross-Site Scripting (XSS) vulnerability in 93digital Typing Effect plugin <= 1.3.6 versions.

    93digital Typing Effect
  • High 7.1
    CVE-2023-27616

    WordPress RSVPMarker Plugin <= 10.6.6 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Stored Cross-Site Scripting (XSS) vulnerability in David F. Carr RSVPMaker plugin <= 10.6.6 versions.

    David F. Carr RSVPMaker
  • Medium 5.9
    CVE-2023-27617

    WordPress RSVPMarker Plugin <= 10.6.6 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in David F. Carr RSVPMaker plugin <= 10.6.6 versions.

    David F. Carr RSVPMaker
  • Medium 5.9
    CVE-2023-40604

    WordPress Cookies by JM Plugin <= 1.0 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Jes Madsen Cookies by JM plugin <= 1.0 versions.

    Jes Madsen Cookies by JM
  • Medium 5.9
    CVE-2023-28790

    WordPress Simple Staff List Plugin <= 2.2.3 is vulnerable to Cross Site Scripting (XSS)

    Auth. (editor+) Stored Cross-Site Scripting (XSS) vulnerability in Brett Shumaker Simple Staff List plugin <= 2.2.3 versions.

    Brett Shumaker Simple Staff List
  • High 7.1
    CVE-2023-28490

    WordPress Mortgage Calculator Estatik Plugin <= 2.0.7 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Estatik Estatik Mortgage Calculator plugin <= 2.0.7 versions.

    Estatik Estatik Mortgage Calculator
  • Medium 4.4
    CVE-2023-4423

    WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce <= 3.1.37.1 - Authenticated (Admin+) Stored Cross-Site Scripting

    The WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 3.1.37.1 due to insufficient input sanitization and out…

    WP Event Manager WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce Web / CMS
  • High 8.8
    CVE-2023-44018 EPSS 16%

    Tenda AC10U v1.0 US_AC10UV1.0RTL_V15.03.06.49_multi_TDE01 was discovered to contain a stack overflow via the domain par…