Skip to content
OpenAdvisories

Archive

13 November 2023

Vulnerabilities first published on this day (UTC), newest first.

← October 2023 2023 / November /13 December 2023 →
  1. 1144
  2. 296
  3. 3108
  4. 48
  5. 57
  6. 6118
  7. 7163
  8. 8111
  9. 9100
  10. 1039
  11. 115
  12. 1236
  13. 1382
  14. 14339
  15. 1575
  16. 16131
  17. 1773
  18. 1844
  19. 191
  20. 2075
  21. 2162
  22. 22168
  23. 2350
  24. 2417
  25. 25 
  26. 269
  27. 2795
  28. 2872
  29. 2957
  30. 30205
All Critical High Medium Low Exploited only Public exploit

38 results · Clear filters · Feed

  • Medium 5.9
    CVE-2023-47657

    WordPress Direct Checkout – Quick View – Buy Now For WooCommerce Plugin <= 1.5.8 is vulnerable to Cross Site Scripting (XSS)

    Auth. (ShopManager+) Stored Cross-Site Scripting (XSS) vulnerability in GrandPlugins Direct Checkout – Quick View – Buy Now For WooCommerce plugin <= 1.5.8 versions.

    GrandPlugins Direct Checkout – Quick View – Buy Now For WooCommerce Web / CMS
  • Medium 5.9
    CVE-2023-47662

    WordPress Live Gold Price & Silver Price Charts Widgets Plugin <= 2.4 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in GoldBroker.Com Live Gold Price & Silver Price Charts Widgets plugin <= 2.4 versions.

    GoldBroker.com Live Gold Price & Silver Price Charts Widgets
  • Medium 6.5
    CVE-2023-47680

    WordPress Qi Addons For Elementor Plugin <= 1.6.3 is vulnerable to Cross Site Scripting (XSS)

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Qode Interactive Qi Addons For Elementor plugin <= 1.6.3 versions.

    Qode Interactive Qi Addons For Elementor
  • Medium 6.1
    CVE-2023-4603

    Star CloudPRNT for WooCommerce <= 2.0.3 - Reflected Cross-Site Scripting

    The Star CloudPRNT for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'printersettings' parameter in versions up to, and including, 2.0.3 due to insufficient input sanitization and output escaping. This makes it possi…

    fmahmood Star CloudPRNT for WooCommerce Web / CMS
  • Medium 6.1
    CVE-2023-42813

    Denial of service from malicious manifest in kyverno

    Kyverno is a policy engine designed for Kubernetes. A security vulnerability was found in Kyverno where an attacker could cause denial of service of Kyverno. The vulnerable component in Kyvernos Notary verifier. An attacker would need control over the registr…

    kyverno kyverno github.com/kyverno/kyverno Go
  • Medium 6.1
    CVE-2023-42816

    Denial of service from malicious signature in kyverno

    Kyverno is a policy engine designed for Kubernetes. A security vulnerability was found in Kyverno where an attacker could cause denial of service of Kyverno. The vulnerability was in Kyvernos Notary verifier. An attacker would need control over the registry f…

    kyverno kyverno github.com/kyverno/kyverno Go
  • Medium 5.3
    CVE-2023-6102

    Maiwei Safety Production Control Platform unrestricted upload

    A vulnerability, which was classified as problematic, was found in Maiwei Safety Production Control Platform 4.1. Affected is an unknown function of the file /Content/Plugins/uploader/FileChoose.html?fileUrl=/Upload/File/Pics/&parent. The manipulation leads t…

    Maiwei Safety Production Control Platform
  • Medium 6.1
    CVE-2023-32123

    WordPress The7 Theme <= 11.7.3 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Dream-Theme The7 allows Stored XSS.This issue affects The7: from n/a through 11.7.3.

    Dream-Theme The7
  • Medium 5.3
    CVE-2023-6101

    Maiwei Safety Production Control Platform Intelligent Monitoring ha.html information disclosure

    A vulnerability, which was classified as problematic, has been found in Maiwei Safety Production Control Platform 4.1. This issue affects some unknown processing of the file /TC/V2.7/ha.html of the component Intelligent Monitoring. The manipulation leads to i…

    Maiwei Safety Production Control Platform
  • Medium 5.3
    CVE-2023-6100

    Maiwei Safety Production Control Platform GetItemList information disclosure

    A vulnerability classified as problematic was found in Maiwei Safety Production Control Platform 4.1. This vulnerability affects unknown code of the file /api/DataDictionary/GetItemList. The manipulation leads to information disclosure. The attack can be init…

    Maiwei Safety Production Control Platform
  • Medium 6.3
    CVE-2023-6098

    Cross-site Scripting on ICSSolution ICS Business Manager

    An XSS vulnerability has been discovered in ICS Business Manager affecting version 7.06.0028.7066. A remote attacker could send a specially crafted string exploiting the obdd_act parameter, allowing the attacker to steal an authenticated user's session, and p…

    ICSSolution ICS Business Manager
  • Medium 6.4
    CVE-2023-4775

    Advanced iFrame <= 2023.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

    The Advanced iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'advanced_iframe' shortcode in versions up to, and including, 2023.8 due to insufficient input sanitization and output escaping on user supplied attributes. This mak…

    mdempfle Advanced iFrame Web / CMS
  • Medium 6.4
    CVE-2023-5741

    POWR <= 2.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

    The POWR plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'powr-powr-pack' shortcode in all versions up to, and including, 2.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This mak…

    powr Custom Form Builder, Contact Forms, Payment Forms, Surveys, Polls Web / CMS
  • Medium 5.8
    CVE-2022-45835 Scanner template EPSS 38%

    WordPress PhonePe Payment Solutions Plugin <= 1.0.15 is vulnerable to Server Side Request Forgery (SSRF)

    Server-Side Request Forgery (SSRF) vulnerability in PhonePe PhonePe Payment Solutions.This issue affects PhonePe Payment Solutions: from n/a through 1.0.15.

    PhonePe PhonePe Payment Solutions
  • Medium 4.4
    CVE-2023-23684

    WordPress WPGraphQL Plugin <= 1.14.5 is vulnerable to Server Side Request Forgery (SSRF)

    Server-Side Request Forgery (SSRF) vulnerability in WPGraphQL.This issue affects WPGraphQL: from n/a through 1.14.5.

    WPGraphQL WPGraphQL wp-graphql/wp-graphql Packagist
  • Medium 4.1
    CVE-2023-46207

    WordPress Motors – Car Dealer & Classified Ads Plugin <= 1.4.6 is vulnerable to Server Side Request Forgery (SSRF)

    Server-Side Request Forgery (SSRF) vulnerability in StylemixThemes Motors – Car Dealer, Classifieds & Listing.This issue affects Motors – Car Dealer, Classifieds & Listing: from n/a through 1.4.6.

    StylemixThemes Motors – Car Dealer, Classifieds & Listing
  • Medium 6.4
    CVE-2023-41239

    WordPress PowerPress Podcasting Plugin <= 11.0.6 is vulnerable to Server Side Request Forgery (SSRF)

    Server-Side Request Forgery (SSRF) vulnerability in Blubrry PowerPress Podcasting plugin by Blubrry.This issue affects PowerPress Podcasting plugin by Blubrry: from n/a through 11.0.6.

    blubrry PowerPress Podcasting plugin by Blubrry
  • Medium 4.4
    CVE-2023-37978

    WordPress HTTP Headers Plugin <= 1.18.11 is vulnerable to Server Side Request Forgery (SSRF)

    Server-Side Request Forgery (SSRF) vulnerability in Dimitar Ivanov HTTP Headers.This issue affects HTTP Headers: from n/a through 1.18.11.

    Dimitar Ivanov HTTP Headers
  • Medium 5.5
    CVE-2023-38515

    WordPress Church Admin Plugin <= 3.7.56 is vulnerable to Server Side Request Forgery (SSRF)

    Server-Side Request Forgery (SSRF) vulnerability in Andy Moyle Church Admin.This issue affects Church Admin: from n/a through 3.7.56.

    andy_moyle Church Admin
  • Medium 4.4
    CVE-2023-34013

    WordPress Poll Maker Plugin <= 4.6.2 is vulnerable to Server Side Request Forgery (SSRF)

    Server-Side Request Forgery (SSRF) vulnerability in Poll Maker Team Poll Maker – Best WordPress Poll Plugin.This issue affects Poll Maker – Best WordPress Poll Plugin: from n/a through 4.6.2.

    Poll Maker Team Poll Maker – Best WordPress Poll Plugin Web / CMS
  • Medium 4.1
    CVE-2023-31219

    WordPress Download Monitor Plugin <= 4.8.1 is vulnerable to Server Side Request Forgery (SSRF)

    Server-Side Request Forgery (SSRF) vulnerability in WPChill Download Monitor.This issue affects Download Monitor: from n/a through 4.8.1.

    WP Chill Download Monitor
  • Medium 6.1
    CVE-2023-38364

    IBM CICS TX Advanced cross-site scripting

    IBM CICS TX Advanced 10.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. …

    IBM CICS TX Advanced
  • Medium 4.3
    CVE-2023-38363

    IBM CICS TX information disclosure

    IBM CICS TX Advanced 10.1 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be …

    IBM CICS TX Advanced
  • Medium 6.3
    CVE-2023-32583

    WordPress WP All Backup Plugin <= 2.4.3 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Prashant Walke WP All Backup plugin <= 2.4.3 versions.

    Prashant Walke WP All Backup
  • Medium 4.3
    CVE-2023-32588

    WordPress Post State Tags Plugin <= 2.0.6 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in BRANDbrilliance Post State Tags plugin <= 2.0.6 versions.

    BRANDbrilliance Post State Tags
  • Medium 4.3
    CVE-2023-33207

    WordPress Stop Referrer Spam Plugin <= 1.3.0 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Krzysztof Wielogórski Stop Referrer Spam plugin <= 1.3.0 versions.

    Krzysztof Wielogórski Stop Referrer Spam
  • Medium 4.3
    CVE-2023-34378

    WordPress WP Hide Post Plugin <= 2.0.10 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in scriptburn.Com WP Hide Post plugin <= 2.0.10 versions.

    scriptburn.com WP Hide Post
  • Medium 5.4
    CVE-2023-34384

    WordPress Kebo Twitter Feed Plugin <= 1.5.12 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Kebo Kebo Twitter Feed plugin <= 1.5.12 versions.

    Kebo Kebo Twitter Feed
  • Medium 5.4
    CVE-2023-47669

    WordPress Profile Builder Plugin <= 3.10.3 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Cozmoslabs User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin <= 3.10.3 versions.

    Cozmoslabs User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
  • Medium 4.3
    CVE-2023-46618

    WordPress Category SEO Meta Tags Plugin <= 2.5 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Bala Krishna, Sergey Yakovlev Category SEO Meta Tags plugin <= 2.5 versions.

    Bala Krishna, Sergey Yakovlev Category SEO Meta Tags
  • Medium 5.4
    CVE-2023-46619

    WordPress Spider Facebook Plugin <= 1.0.15 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in WebDorado WDSocialWidgets plugin <= 1.0.15 versions.

    WebDorado WDSocialWidgets
  • Medium 4.3
    CVE-2023-46620

    WordPress DeepL Pro API translation Plugin <= 2.3.9.1 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Fluenx DeepL API translation plugin <= 2.3.9.1 versions.

    Fluenx DeepL API translation plugin
  • Medium 4.3
    CVE-2023-46625

    WordPress Autolinks Manager Plugin <= 1.10.04 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in DAEXT Autolinks Manager plugin <= 1.10.04 versions.

    daext Autolinks Manager
  • Medium 4.3
    CVE-2023-46629

    WordPress Remove Add to Cart WooCommerce Plugin <= 1.4.4 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in themelocation Remove Add to Cart WooCommerce plugin <= 1.4.4.

    themelocation Remove Add to Cart WooCommerce Web / CMS
  • Medium 5.4
    CVE-2023-46636

    WordPress Custom Header Images Plugin <= 1.2.1 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in David Stöckl Custom Header Images plugin <= 1.2.1 versions.

    David Stockl Custom Header Images
  • Medium 4.3
    CVE-2023-46638

    WordPress WCP OpenWeather Plugin <= 2.5.0 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Webcodin WCP OpenWeather plugin <= 2.5.0 versions.

    WebCodin WCP OpenWeather
  • Medium 5.4
    CVE-2023-47230

    WordPress Contact Forms by Cimatti Plugin <= 1.6.0 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Cimatti Consulting WordPress Contact Forms by Cimatti plugin <= 1.6.0 versions.

    Cimatti Consulting WordPress Contact Forms by Cimatti Web / CMS
  • Medium 4.3
    CVE-2023-26543

    WordPress WP Meteor Page Speed Optimization Topping Plugin <= 3.1.4 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Aleksandr Guidrevitch WP Meteor Website Speed Optimization Addon plugin <= 3.1.4 versions.

    Aleksandr Guidrevitch WP Meteor Website Speed Optimization Addon