Skip to content
OpenAdvisories

Archive

18 November 2023

Vulnerabilities first published on this day (UTC), newest first.

← October 2023 2023 / November /18 December 2023 →
  1. 1144
  2. 296
  3. 3108
  4. 48
  5. 57
  6. 6118
  7. 7163
  8. 8111
  9. 9100
  10. 1039
  11. 115
  12. 1236
  13. 1382
  14. 14339
  15. 1575
  16. 16131
  17. 1773
  18. 1844
  19. 191
  20. 2075
  21. 2162
  22. 22168
  23. 2350
  24. 2417
  25. 25 
  26. 269
  27. 2795
  28. 2872
  29. 2957
  30. 30205
All Critical High Medium Low Exploited only Public exploit

44 results · Feed

  • Medium 6.5
    CVE-2023-28780

    WordPress Yoast SEO: Local Plugin <= 14.8 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Yoast Yoast Local Premium.This issue affects Yoast Local Premium: from n/a through 14.8.

    Yoast Yoast Local Premium
  • Medium 5.4
    CVE-2023-31075

    WordPress Easy Hide Login Plugin <= 1.0.8 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Arshid Easy Hide Login.This issue affects Easy Hide Login: from n/a through 1.0.8.

    Arshid Easy Hide Login
  • Medium 4.3
    CVE-2023-31089

    WordPress Video XML Sitemap Generator Plugin <= 1.0.0 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Tradebooster Video XML Sitemap Generator.This issue affects Video XML Sitemap Generator: from n/a through 1.0.0.

    Tradebooster Video XML Sitemap Generator
  • Medium 5.4
    CVE-2023-32245

    WordPress Essential Addons for Elementor Pro Plugin <= 5.4.8 is vulnerable to Server Side Request Forgery (SSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in WPDeveloper Essential Addons for Elementor Pro.This issue affects Essential Addons for Elementor Pro: from n/a through 5.4.8.

    WPDeveloper Essential Addons for Elementor Pro
  • Medium 5.4
    CVE-2023-32504

    WordPress Wise Chat Plugin <= 3.1.3 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Kainex Wise Chat.This issue affects Wise Chat: from n/a through 3.1.3.

    Kainex Wise Chat
  • Medium 5.4
    CVE-2023-32514

    WordPress Google Site Verification plugin using Meta Tag Plugin <= 1.2 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Himanshu Parashar Google Site Verification plugin using Meta Tag.This issue affects Google Site Verification plugin using Meta Tag: from n/a through 1.2.

    Himanshu Parashar Google Site Verification plugin using Meta Tag
  • Medium 4.3
    CVE-2023-25985

    WordPress WordPress Tooltips Plugin <= 8.2.5 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Tomas | Docs | FAQ | Premium Support WordPress Tooltips.This issue affects WordPress Tooltips: from n/a through 8.2.5.

    Tomas | Docs | FAQ | Premium Support WordPress Tooltips Web / CMS
  • Medium 4.3
    CVE-2023-41129

    WordPress Patreon WordPress Plugin <= 1.8.6 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Patreon Patreon WordPress.This issue affects Patreon WordPress: from n/a through 1.8.6.

    Patreon Patreon WordPress Web / CMS
  • Medium 5.4
    CVE-2023-47243

    WordPress MSHOP MY SITE Plugin <= 1.1.6 is vulnerable to Broken Access Control

    Cross-Site Request Forgery (CSRF) vulnerability in CodeMShop 코드엠샵 마이사이트 – MSHOP MY SITE.This issue affects 코드엠샵 마이사이트 – MSHOP MY SITE: from n/a through 1.1.6.

    CodeMShop 코드엠샵 마이사이트 – MSHOP MY SITE
  • Medium 4.3
    CVE-2023-47519

    WordPress WooCommerce Product Table Lite Plugin <= 2.6.2 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in WC Product Table WooCommerce Product Table Lite.This issue affects WooCommerce Product Table Lite: from n/a through 2.6.2.

    WC Product Table WooCommerce Product Table Lite Web / CMS
  • Medium 4.3
    CVE-2023-47531

    WordPress Droit Dark Mode Plugin <= 1.1.2 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in DroitThemes Droit Dark Mode.This issue affects Droit Dark Mode: from n/a through 1.1.2.

    DroitThemes Droit Dark Mode
  • Medium 5.4
    CVE-2023-47551

    WordPress Donations Made Easy – Smart Donations Plugin <= 4.0.12 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in RedNao Donations Made Easy – Smart Donations.This issue affects Donations Made Easy – Smart Donations: from n/a through 4.0.12.

    RedNao Donations Made Easy – Smart Donations
  • Medium 5.4
    CVE-2023-47552

    WordPress Image Hover Effects Plugin <= 5.5 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Labib Ahmed Image Hover Effects – WordPress Plugin.This issue affects Image Hover Effects – WordPress Plugin: from n/a through 5.5.

    Labib Ahmed Image Hover Effects – WordPress Plugin Web / CMS
  • Medium 5.4
    CVE-2023-47553

    WordPress UserHeat Plugin Plugin <= 1.1.6 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in User Local Inc UserHeat Plugin.This issue affects UserHeat Plugin: from n/a through 1.1.6.

    User Local UserHeat Plugin
  • Medium 4.3
    CVE-2023-47556

    WordPress Device Theme Switcher Plugin <= 3.0.2 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in James Mehorter Device Theme Switcher.This issue affects Device Theme Switcher: from n/a through 3.0.2.

    James Mehorter Device Theme Switcher
  • Medium 5.4
    CVE-2023-47644

    WordPress ProfileGrid Plugin <= 5.6.6 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in profilegrid ProfileGrid – User Profiles, Memberships, Groups and Communities.This issue affects ProfileGrid – User Profiles, Memberships, Groups and Communities: from n/a through 5.6.6.

    Profilegrid ProfileGrid – User Profiles, Memberships, Groups and Communities
  • Medium 5.4
    CVE-2023-47649

    WordPress Best Restaurant Menu by PriceListo Plugin <= 1.3.1 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in PriceListo Best Restaurant Menu by PriceListo.This issue affects Best Restaurant Menu by PriceListo: from n/a through 1.3.1.

    PriceListo Best Restaurant Menu by PriceListo
  • Medium 6.5
    CVE-2023-47650

    WordPress Add Local Avatar Plugin <= 12.1 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Peter Sterling Add Local Avatar.This issue affects Add Local Avatar: from n/a through 12.1.

    Peter Sterling Add Local Avatar
  • Medium 4.3
    CVE-2023-47651

    WordPress WP Links Page Plugin <= 4.9.4 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Robert Macchi WP Links Page.This issue affects WP Links Page: from n/a through 4.9.4.

    Robert Macchi WP Links Page
  • Medium 5.4
    CVE-2023-47655

    WordPress ANAC XML Bandi di Gara Plugin <= 7.5 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Marco Milesi ANAC XML Bandi di Gara.This issue affects ANAC XML Bandi di Gara: from n/a through 7.5.

    Marco Milesi ANAC XML Bandi di Gara
  • Medium 6.5
    CVE-2023-47664

    WordPress Plainview Protect Passwords Plugin <= 1.4 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in edward_plainview Plainview Protect Passwords.This issue affects Plainview Protect Passwords: from n/a through 1.4.

    edward_plainview Plainview Protect Passwords
  • Medium 4.3
    CVE-2023-47666

    WordPress Code Snippets Plugin <= 3.5.0 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Code Snippets Pro Code Snippets.This issue affects Code Snippets: from n/a through 3.5.0.

    Code Snippets Pro Code Snippets
  • Medium 4.3
    CVE-2023-47667

    WordPress WP Full Stripe Free plugin <= 7.0.16 - Cross Site Request Forgery (CSRF) vulnerability on every Setting Save

    Cross-Site Request Forgery (CSRF) vulnerability in Mammothology WP Full Stripe Free.This issue affects WP Full Stripe Free: from n/a through 7.0.16.

    Mammothology WP Full Stripe Free
  • Medium 4.3
    CVE-2023-47670

    WordPress Korea SNS Plugin <= 1.6.3 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Jongmyoung Kim Korea SNS.This issue affects Korea SNS: from n/a through 1.6.3.

    Jongmyoung Kim Korea SNS
  • Medium 5.4
    CVE-2023-47671

    WordPress Vertical scroll recent post Plugin <= 14.0 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Gopi Ramasamy Vertical scroll recent.This issue affects Vertical scroll recent post: from n/a through 14.0.

    Gopi Ramasamy Vertical scroll recent post
  • Medium 4.3
    CVE-2023-47672

    WordPress WP Category Post List Widget Plugin <= 2.0.3 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Swashata WP Category Post List Widget.This issue affects WP Category Post List Widget: from n/a through 2.0.3.

    Swashata WP Category Post List Widget
  • Medium 5.4
    CVE-2023-47685

    WordPress Preloader Matrix Plugin <= 2.0.1 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Lukman Nakib Preloader Matrix.This issue affects Preloader Matrix: from n/a through 2.0.1.

    Lukman Nakib Preloader Matrix
  • Medium 5.9
    CVE-2023-38361

    IBM CICS TX Advanced information disclosure

    IBM CICS TX Advanced 10.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 260770.

    IBM CICS TX Advanced
  • High 8.1
    CVE-2023-40363

    IBM InfoSphere Information Server privilege escalation

    IBM InfoSphere Information Server 11.7 could allow an authenticated user to change installation files due to incorrect file permission settings. IBM X-Force ID: 263332.

    IBM InfoSphere Information Server
  • Unscored —
    RUSTSEC-2023-0123

    `hann-rs-service` was removed from crates.io for malicious code

    This crate was part of a typosquatting malware cluster published by the user `TerryDavisSoldier` to run an arbitrary malware payload on Windows hosts. This advisory is to retrospectively document this attempted attack. The version information and download rec…

    hann-rs-service crates.io
  • Unscored —
    RUSTSEC-2023-0119

    `openvpn-plugin-rs` was removed from crates.io for malicious code

    This crate was part of a typosquatting malware cluster published by the user `TerryDavisSoldier` to run an arbitrary malware payload on Windows hosts. This advisory is to retrospectively document this attempted attack. The version information and download rec…

    openvpn-plugin-rs crates.io
  • Unscored —
    RUSTSEC-2023-0105

    `windowsservice` was removed from crates.io for malicious code

    This crate was part of a typosquatting malware cluster published by the user `TerryDavisSoldier` to run an arbitrary malware payload on Windows hosts. This advisory is to retrospectively document this attempted attack. The version information and download rec…

    windowsservice crates.io
  • High 7.5
    CVE-2023-6187 EPSS 51%

    Paid Memberships Pro <= 2.12.3 - Authenticated (Subscriber+) Arbitrary File Upload

    The Paid Memberships Pro plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'pmpro_paypalexpress_session_vars_for_user_fields' function in versions up to, and including, 2.12.3. This makes it possible …

    Stranger Studios Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions Web / CMS
  • High 8.1
    CVE-2023-4214

    AppPresser <= 4.2.5 - Insecure Password Reset Mechanism

    The AppPresser plugin for WordPress is vulnerable to unauthorized password resets in versions up to, and including 4.2.5. This is due to the plugin generating too weak a reset code, and the code used to reset the password has no attempt or time limit.

    scottopolis AppPresser – Mobile App Framework Web / CMS
  • Unscored —
    CVE-2023-48736

    In International Color Consortium DemoIccMAX 3e7948b, CIccCLUT::Interp2d in IccTagLut.cpp in libSampleICC.a has an out-…

  • Unscored —
    CVE-2023-48017

    Dreamer_cms 4.1.3 is vulnerable to Cross Site Request Forgery (CSRF) via Add permissions to CSRF in Permission Manageme…

  • Medium 6.1
    CVE-2023-40809

    Cross-site Scripting in OpenCRX

    OpenCRX version 5.2.0 is vulnerable to HTML injection via the Activity Search Criteria-Activity Number.

    org.opencrx:opencrx-core-models Maven
  • Medium 6.1
    CVE-2023-40815

    Cross-site Scripting in OpenCRX

    OpenCRX version 5.2.0 is vulnerable to HTML injection via the Category Creation Name Field.

    org.opencrx:opencrx-core-models Maven
  • Medium 6.1
    CVE-2023-40812

    Cross-site Scripting in OpenCRX

    OpenCRX version 5.2.0 is vulnerable to HTML injection via the Accounts Group Name Field.

    org.opencrx:opencrx-core-models Maven
  • Medium 6.1
    CVE-2023-40816

    Cross-site Scripting in OpenCRX

    OpenCRX version 5.2.0 is vulnerable to HTML injection via Activity Milestone Name Field.

    org.opencrx:opencrx-core-models Maven