Skip to content
OpenAdvisories

Archive

22 November 2023

Vulnerabilities first published on this day (UTC), newest first.

← October 2023 2023 / November /22 December 2023 →
  1. 1144
  2. 296
  3. 3108
  4. 48
  5. 57
  6. 6118
  7. 7163
  8. 8111
  9. 9100
  10. 1039
  11. 115
  12. 1236
  13. 1382
  14. 14339
  15. 1575
  16. 16131
  17. 1773
  18. 1844
  19. 191
  20. 2075
  21. 2162
  22. 22168
  23. 2350
  24. 2417
  25. 25 
  26. 269
  27. 2795
  28. 2872
  29. 2957
  30. 30205
All Critical High Medium Low Exploited only Public exploit

99 results · Clear filters · Feed

  • Medium 6.5
    CVE-2023-40002

    WordPress Booster for WooCommerce Plugin <= 7.1.1 is vulnerable to Sensitive Data Exposure

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Pluggabl LLC Booster for WooCommerce plugin <= 7.1.1 versions.

    Pluggabl Booster for WooCommerce Web / CMS
  • Medium 4.3
    CVE-2023-23978

    WordPress WP Client Reports Plugin <= 1.0.16 is vulnerable to Sensitive Data Exposure

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in SwitchWP WP Client Reports plugin <= 1.0.16 versions.

    SwitchWP WP Client Reports
  • Medium 6.5
    CVE-2023-47839

    WordPress eCommerce Product Catalog Plugin <= 3.3.26 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in impleCode eCommerce Product Catalog Plugin for WordPress plugin <= 3.3.26 versions.

    impleCode eCommerce Product Catalog Plugin for WordPress Web / CMS
  • Medium 6.5
    CVE-2023-47835

    WordPress ARI Stream Quiz Plugin <= 1.2.32 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ARI Soft ARI Stream Quiz – WordPress Quizzes Builder plugin <= 1.2.32 versions.

    ARI Soft ARI Stream Quiz – WordPress Quizzes Builder Web / CMS
  • Medium 6.5
    CVE-2023-47834

    WordPress Quiz And Survey Master Plugin <= 8.1.13 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ExpressTech Quiz And Survey Master plugin <= 8.1.13 versions.

    ExpressTech Systems Quiz And Survey Master
  • Medium 5.9
    CVE-2023-47833

    WordPress Theater for WordPress Plugin <= 0.18.3 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeroen Schmit Theater for WordPress plugin <= 0.18.3 versions.

    Jeroen Schmit Theater for WordPress Web / CMS
  • Medium 6.5
    CVE-2023-47831

    WordPress DrawIt (draw.io) Plugin <= 1.1.3 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in assorted[chips] DrawIt (draw.Io) plugin <= 1.1.3 versions.

    assorted[chips] DrawIt (draw.io)
  • Medium 5.9
    CVE-2023-47829

    WordPress Quick Call Button Plugin <= 1.2.9 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Codez Quick Call Button plugin <= 1.2.9 versions.

    Codez Quick Call Button
  • Medium 6.5
    CVE-2023-47821

    WordPress Email Encoder Bundle Plugin <= 2.1.8 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jannis Thuemmig Email Encoder plugin <= 2.1.8 versions.

    Jannis Thuemmig Email Encoder
  • Medium 6.5
    CVE-2023-47817

    WordPress Daily Prayer Time Plugin <= 2023.10.13 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mmrs151 Daily Prayer Time plugin <= 2023.10.13 versions.

    mmrs151 Daily Prayer Time
  • Medium 6.5
    CVE-2023-47816

    WordPress Charitable Plugin <= 1.7.0.13 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Charitable Donations & Fundraising Team Donation Forms by Charitable plugin <= 1.7.0.13 versions.

    Charitable Donations & Fundraising Team Donation Forms by Charitable
  • Medium 6.5
    CVE-2023-47815

    WordPress BP Profile Shortcodes Extra Plugin <= 2.5.2 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Venutius BP Profile Shortcodes Extra plugin <= 2.5.2 versions.

    Venutius BP Profile Shortcodes Extra
  • Medium 6.5
    CVE-2023-47814

    WordPress BMI Calculator Plugin Plugin <= 1.0.3 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Waterloo Plugins BMI Calculator Plugin plugin <= 1.0.3 versions.

    Waterloo Plugins BMI Calculator Plugin
  • Medium 6.5
    CVE-2023-47813

    WordPress Better RSS Widget Plugin <= 2.8.1 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in grandslambert Better RSS Widget plugin <= 2.8.1 versions.

    GrandSlambert Better RSS Widget
  • Medium 6.5
    CVE-2023-47812

    WordPress Bamboo Columns Plugin <= 1.6.1 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bamboo Mcr Bamboo Columns plugin <= 1.6.1 versions.

    Bamboo Mcr Bamboo Columns
  • Medium 6.5
    CVE-2023-47811

    WordPress Anywhere Flash Embed Plugin <= 1.0.5 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Suresh KUMAR Mukhiya Anywhere Flash Embed plugin <= 1.0.5 versions.

    Suresh Kumar Mukhiya Anywhere Flash Embed
  • Medium 6.5
    CVE-2023-47810

    WordPress Ajax Domain Checker Plugin <= 1.3.0 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Asdqwe Dev Ajax Domain Checker plugin <= 1.3.0 versions.

    Asdqwe Dev Ajax Domain Checker
  • Medium 5.9
    CVE-2023-47809

    WordPress Accordion Plugin <= 2.6 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themepoints Accordion plugin <= 2.6 versions.

    Themepoints Accordion
  • Medium 6.5
    CVE-2023-47808

    WordPress Add Widgets to Page Plugin <= 1.3.2 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Christina Uechi Add Widgets to Page plugin <= 1.3.2 versions.

    Christina Uechi Add Widgets to Page
  • Medium 6.5
    CVE-2023-47786

    WordPress LayerSlider Plugin <= 7.7.9 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LayerSlider plugin <= 7.7.9 versions.

    LayerSlider LayerSlider
  • Medium 5.9
    CVE-2023-47759

    WordPress Chaty plugin <= 3.1.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Premio Chaty chaty allows DOM-Based XSS.This issue affects Chaty: from n/a through <= 3.1.2.

    Premio Chaty
  • Medium 6.5
    CVE-2023-6265

    DrayTek Vigor2960 mainfunction.cgi dumpSyslog 'option' directory traversal

    ** UNSUPPORTED WHEN ASSIGNED ** Draytek Vigor2960 v1.5.1.4 and v1.5.1.5 are vulnerable to directory traversal via the mainfunction.cgi dumpSyslog 'option' parameter allowing an authenticated attacker with access to the web management interface to delete arbit…

    DrayTek Vigor2960 Network devices
  • Medium 4.3
    CVE-2023-47825

    WordPress WP EXtra Plugin <= 6.4 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in TienCOP WP EXtra plugin <= 6.4 versions.

    TienCOP WP EXtra
  • Medium 5.4
    CVE-2023-47824

    WordPress Legal Pages Plugin <= 1.3.8 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in wpWax Legal Pages – Privacy Policy, Terms & Conditions, GDPR, CCPA, and Cookie Notice Generator plugin <= 1.3.8 versions.

    wpWax Legal Pages – Privacy Policy, Terms & Conditions, GDPR, CCPA, and Cookie Notice Generator
  • Medium 4.3
    CVE-2023-47819

    WordPress Easy Call Now by ThikShare Plugin <= 1.1.0 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Dang Ngoc Binh Easy Call Now by ThikShare plugin <= 1.1.0 versions.

    Dang Ngoc Binh Easy Call Now by ThikShare
  • Medium 6.2
    CVE-2023-25682

    IBM Sterling B2B Integrator information disclosure

    IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.8 and 6.1.0.0 through 6.1.2.1 stores potentially sensitive information in log files that could be read by a local user. IBM X-Force ID: 247034.

    IBM Sterling B2B Integrator Standard Edition
  • Medium 5.4
    CVE-2023-39925

    WordPress Community by PeepSo Plugin <= 6.1.6.0 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in PeepSo Download Community by PeepSo plugin <= 6.1.6.0 versions.

    PeepSo Download Community by PeepSo
  • Medium 4.3
    CVE-2023-47792

    WordPress Big File Uploads Plugin <= 2.1.1 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Infinite Uploads Big File Uploads – Increase Maximum File Upload Size plugin <= 2.1.1 versions.

    Infinite Uploads Big File Uploads – Increase Maximum File Upload Size
  • Medium 4.3
    CVE-2023-47791

    WordPress Leadster Plugin <= 1.1.2 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Leadster plugin <= 1.1.2 versions.

    Leadster Leadster
  • Medium 4.3
    CVE-2022-36777

    IBM Cloud Pak for Security information disclosure

    IBM Cloud Pak for Security (CP4S) 1.10.0.0 through 1.10.11.0 and IBM QRadar Suite Software 1.10.12.0 through 1.10.16.0could allow an authenticated user to obtain sensitive version information that could aid in further attacks against the system. IBM X-Force I…

    IBM Cloud Pak for Security QRadar Suite Software
  • Medium 4.3
    CVE-2023-47775

    WordPress wpDiscuz Plugin <= 7.6.11 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in gVectors Team Comments — wpDiscuz plugin <= 7.6.11 versions.

    gVectors Team Comments — wpDiscuz
  • Medium 4.3
    CVE-2023-47765

    WordPress CodeBard's Patron Button and Widgets for Patreon Plugin <= 2.1.9 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in CodeBard CodeBard's Patron Button and Widgets for Patreon plugin <= 2.1.9 versions.

    CodeBard CodeBard's Patron Button and Widgets for Patreon
  • Medium 5.4
    CVE-2023-47758

    WordPress Multi Step Form Plugin <= 1.7.11 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Mondula GmbH Multi Step Form plugin <= 1.7.11 versions.

    Mondula Multi Step Form
  • Medium 6.5
    CVE-2023-47755

    WordPress WooCommerce Product Carousel Slider Plugin <= 3.3.5 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AazzTech WooCommerce Product Carousel Slider plugin <= 3.3.5 versions.

    aazztech WooCommerce Product Carousel Slider Web / CMS
  • Medium 4.3
    CVE-2023-25986

    WordPress PayGreen Plugin <= 4.10.2 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in WattIsIt PayGreen – Ancienne version plugin <= 4.10.2 versions.

    WattIsIt PayGreen – Ancienne version
  • Medium 4.3
    CVE-2023-25987

    WordPress YouTube Channel Plugin <= 3.23.3 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Aleksandar Urošević My YouTube Channel plugin <= 3.23.3 versions.

    Aleksandar Urošević My YouTube Channel
  • Medium 5.5
    CVE-2023-20241

    Multiple vulnerabilities in Cisco Secure Client Software, formerly AnyConnect Secure Mobility Client, could allow an au…

    Cisco Cisco Secure Client Network devices
  • Medium 5.5
    CVE-2023-20240

    Multiple vulnerabilities in Cisco Secure Client Software, formerly AnyConnect Secure Mobility Client, could allow an au…

    Cisco Cisco Secure Client Network devices
  • Medium 5.0
    CVE-2023-20084

    A vulnerability in the endpoint software of Cisco Secure Endpoint for Windows could allow an authenticated, local attac…

    Cisco Cisco Secure Endpoint Network devices
  • Medium 6.3
    CVE-2023-6008

    UserPro <= 5.1.1 - Cross-Site Request Forgery via multiple functions

    The UserPro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.1.1. This is due to missing or incorrect nonce validation on multiple functions. This makes it possible for unauthenticated attackers to add, modi…

    Web / CMS