Skip to content
OpenAdvisories

Archive

November 2023

Vulnerabilities first published in this month (UTC), newest first.

← October 2023 2023 / November December 2023 →
  1. 1144
  2. 296
  3. 3108
  4. 48
  5. 57
  6. 6118
  7. 7163
  8. 8111
  9. 9100
  10. 1039
  11. 115
  12. 1236
  13. 1382
  14. 14339
  15. 1575
  16. 16131
  17. 1773
  18. 1844
  19. 191
  20. 2075
  21. 2162
  22. 22168
  23. 2350
  24. 2417
  25. 25 
  26. 269
  27. 2795
  28. 2872
  29. 2957
  30. 30205
All Critical High Medium Low Exploited only Public exploit

2,490 results · Feed

  • Medium 6.5
    CVE-2023-47877

    WordPress Perfmatters Plugin < 2.2.0 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Perfmatters allows Stored XSS.This issue affects Perfmatters: from n/a before 2.2.0.

    Perfmatters perfmatters
  • High 7.1
    CVE-2023-48272

    WordPress Maspik – Spam blacklist Plugin <= 0.9.2 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in yonifre Maspik – Spam Blacklist allows Stored XSS.This issue affects Maspik – Spam Blacklist: from n/a through 0.9.2.

    yonifre Maspik – Spam blacklist
  • Medium 6.5
    CVE-2023-48317

    WordPress Display Custom Post Plugin <= 2.2.1 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vikas Vatsa Display Custom Post allows Stored XSS.This issue affects Display Custom Post: from n/a through 2.2.1.

    Vikas Vatsa Display Custom Post
  • Medium 5.9
    CVE-2023-48320

    WordPress Video Player Plugin <= 1.5.22 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WebDorado SpiderVPlayer allows Stored XSS.This issue affects SpiderVPlayer: from n/a through 1.5.22.

    WebDorado SpiderVPlayer
  • Medium 6.5
    CVE-2023-48321

    WordPress Accelerated Mobile Pages Plugin <= 1.0.88.1 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ahmed Kaludi, Mohammed Kaludi AMP for WP – Accelerated Mobile Pages allows Stored XSS.This issue affects AMP for WP – Accelerated Mobile Pages: from n/a thro…

    Ahmed Kaludi, Mohammed Kaludi AMP for WP – Accelerated Mobile Pages
  • High 7.1
    CVE-2023-48746

    WordPress Community by PeepSo Plugin <= 6.2.6.0 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PeepSo Community by PeepSo – Social Network, Membership, Registration, User Profiles allows Reflected XSS.This issue affects Community by PeepSo – Social Net…

    PeepSo Community by PeepSo – Social Network, Membership, Registration, User Profiles
  • High 7.1
    CVE-2023-48748

    WordPress Salient Core Plugin <= 2.0.2 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Theme nectar Salient Core allows Reflected XSS.This issue affects Salient Core: from n/a through 2.0.2.

    Theme nectar Salient Core
  • High 7.1
    CVE-2023-48752

    WordPress Happyforms Plugin <= 1.25.9 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Happyforms Form builder to get in touch with visitors, grow your email list and collect payments — Happyforms allows Reflected XSS.This issue affects Form bu…

    Happyforms Form builder to get in touch with visitors, grow your email list and collect payments — Happyforms
  • Medium 6.5
    CVE-2023-48749

    WordPress Salient Core Plugin <= 2.0.2 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Theme nectar Salient Core allows Stored XSS.This issue affects Salient Core: from n/a through 2.0.2.

    Theme nectar Salient Core
  • Medium 5.4
    CVE-2023-47875

    WordPress Perfmatters Plugin <= 2.1.6 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Perfmatters allows Cross Site Request Forgery.This issue affects Perfmatters: from n/a through 2.1.6.

    Perfmatters perfmatters
  • High 7.1
    CVE-2023-48278

    WordPress WP Forms Puzzle Captcha Plugin <= 4.1 is vulnerable to Cross Site Request Forgery (CSRF) leading to XSS

    Cross-Site Request Forgery (CSRF) vulnerability in Nitin Rathod WP Forms Puzzle Captcha allows Stored XSS.This issue affects WP Forms Puzzle Captcha: from n/a through 4.1.

    Nitin Rathod WP Forms Puzzle Captcha
  • Medium 4.3
    CVE-2023-48328

    WordPress NextGEN Gallery Plugin <= 3.37 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Imagely WordPress Gallery Plugin – NextGEN Gallery allows Cross Site Request Forgery.This issue affects WordPress Gallery Plugin – NextGEN Gallery: from n/a through 3.37.

    Imagely WordPress Gallery Plugin – NextGEN Gallery Web / CMS
  • Medium 5.4
    CVE-2023-48754

    WordPress Delete Post Revisions In WordPress Plugin <= 4.6 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Wap Nepal Delete Post Revisions In WordPress allows Cross Site Request Forgery.This issue affects Delete Post Revisions In WordPress: from n/a through 4.6.

    Wap Nepal Delete Post Revisions In WordPress Web / CMS
  • Medium 4.3
    CVE-2023-5803

    WordPress Business Directory Plugin Plugin <= 6.3.10 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Business Directory Team Business Directory Plugin – Easy Listing Directories for WordPress allows Cross-Site Request Forgery.This issue affects Business Directory Plugin – Easy Listing Directories for WordPre…

    Business Directory Team Business Directory Plugin – Easy Listing Directories for WordPress Web / CMS
  • Medium 6.5
    CVE-2023-44143

    WordPress Bamboo Columns Plugin <= 1.6.1 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bamboo Mcr Bamboo Columns allows Stored XSS.This issue affects Bamboo Columns: from n/a through 1.6.1.

    Bamboo Mcr Bamboo Columns
  • Medium 6.5
    CVE-2023-45609

    WordPress Powr Pack Plugin <= 2.1.0 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in POWR.Io Contact Form – Custom Builder, Payment Form, and More allows Stored XSS.This issue affects Contact Form – Custom Builder, Payment Form, and More: fro…

    POWR.io Contact Form – Custom Builder, Payment Form, and More
  • High 7.1
    CVE-2023-46086

    WordPress affiliate-toolkit – WordPress Affiliate Plugin Plugin <= 3.4.3 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SERVIT Software Solutions affiliate-toolkit – WordPress Affiliate Plugin allows Reflected XSS.This issue affects affiliate-toolkit – WordPress Affiliate Plug…

    SERVIT Software Solutions affiliate-toolkit – WordPress Affiliate Plugin Web / CMS
  • Medium 5.9
    CVE-2023-39921

    WordPress Molongui Plugin <= 4.6.19 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Molongui Author Box, Guest Author and Co-Authors for Your Posts – Molongui allows Stored XSS.This issue affects Author Box, Guest Author and Co-Authors for Y…

    molongui Author Box, Guest Author and Co-Authors for Your Posts – Molongui
  • Medium 5.3
    CVE-2023-25057

    WordPress Libsyn Publisher Hub Plugin <= 1.3.2 is vulnerable to Sensitive Data Exposure

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Libsyn Libsyn Publisher Hub.This issue affects Libsyn Publisher Hub: from n/a through 1.3.2.

    libsyn Libsyn Publisher Hub
  • Medium 6.5
    CVE-2023-26533

    WordPress Zippy Plugin <= 1.6.1 is vulnerable to Sensitive Data Exposure

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Gesundheit Bewegt GmbH Zippy.This issue affects Zippy: from n/a through 1.6.1.

    Gesundheit Bewegt Zippy
  • Medium 5.3
    CVE-2023-36507

    WordPress BookingPress Plugin <= 1.0.64 is vulnerable to Sensitive Data Exposure

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Repute Infosystems BookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin.This issue affects BookingPress – Appointment Booking Calendar Plugin and Online Sch…

    Repute InfoSystems BookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin
  • Medium 5.3
    CVE-2023-36523

    WordPress Email download link Plugin <= 3.7 is vulnerable to Sensitive Data Exposure

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Gopi Ramasamy Email download link.This issue affects Email download link: from n/a through 3.7.

    Gopi Ramasamy Email download link
  • Medium 6.5
    CVE-2023-37868

    WordPress Premium Addons PRO Plugin <= 2.9.0 is vulnerable to Sensitive Data Exposure

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Leap13 Premium Addons PRO.This issue affects Premium Addons PRO: from n/a through 2.9.0.

    leap13 Premium Addons PRO
  • High 8.6
    CVE-2023-6360 Public exploit Scanner template EPSS 63%

    The 'My Calendar' WordPress Plugin, version < 3.4.22 is affected by an unauthenticated SQL injection vulnerability in t…

    Web / CMS
  • Medium 4.3
    CVE-2023-37890

    WordPress KB Support Plugin <= 1.5.88 is vulnerable to Broken Access Control

    Missing Authorization vulnerability in WPOmnia KB Support – WordPress Help Desk and Knowledge Base allows Accessing Functionality Not Properly Constrained by ACLs. Users with a role as low as a subscriber can view other customers.This issue affects KB Support…

    WPOmnia KB Support – WordPress Help Desk and Knowledge Base Web / CMS
  • Medium 5.3
    CVE-2023-37972

    WordPress WooCommerce Product Stock Alert Plugin <= 2.0.1 is vulnerable to Sensitive Data Exposure

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in MultiVendorX Product Stock Manager & Notifier for WooCommerce.This issue affects Product Stock Manager & Notifier for WooCommerce: from n/a through 2.0.1.

    MultiVendorX Product Stock Manager & Notifier for WooCommerce Web / CMS
  • High 7.5
    CVE-2023-40211 Scanner template

    WordPress Post Grid Plugin <= 2.2.50 is vulnerable to Sensitive Data Exposure

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in PickPlugins Post Grid Combo – 36+ Gutenberg Blocks.This issue affects Post Grid Combo – 36+ Gutenberg Blocks: from n/a through 2.2.50.

    PickPlugins Post Grid Combo – 36+ Gutenberg Blocks
  • Medium 5.3
    CVE-2023-40600 Public exploit Scanner template

    WordPress EWWW Image Optimizer Plugin <= 7.2.0 is vulnerable to Sensitive Data Exposure

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Exactly WWW EWWW Image Optimizer. It works only when debug.log is turned on.This issue affects EWWW Image Optimizer: from n/a through 7.2.0.

    Exactly WWW EWWW Image Optimizer
  • Medium 6.3
    CVE-2023-6402

    PHPGurukul Nipah Virus Testing Management System add-phlebotomist.php sql injection

    A vulnerability, which was classified as critical, was found in PHPGurukul Nipah Virus Testing Management System 1.0. This affects an unknown part of the file add-phlebotomist.php. The manipulation of the argument empid leads to sql injection. It is possible …

    PHPGurukul Nipah Virus Testing Management System
  • Medium 5.3
    CVE-2023-40662

    WordPress Cookies and Content Security Policy Plugin <= 2.15 is vulnerable to Sensitive Data Exposure

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Jonk @ Follow me Darling Cookies and Content Security Policy.This issue affects Cookies and Content Security Policy: from n/a through 2.15.

    Jonk @ Follow me Darling Cookies and Content Security Policy
  • Medium 5.3
    CVE-2023-41735

    WordPress Email posts to subscribers Plugin <= 6.2 is vulnerable to Sensitive Data Exposure

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Gopi Ramasamy Email posts to subscribers.This issue affects Email posts to subscribers: from n/a through 6.2.

    Gopi Ramasamy Email posts to subscribers
  • High 7.5
    CVE-2023-44150

    WordPress ProfilePress Plugin <= 4.13.2 is vulnerable to Sensitive Data Exposure

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ProfilePress Membership Team Paid Membership Plugin, Ecommerce, Registration Form, Login Form, User Profile & Restrict Content – ProfilePress.This issue affects Paid Membership Plugin…

    ProfilePress Membership Team Paid Membership Plugin, Ecommerce, Registration Form, Login Form, User Profile & Restrict Content – ProfilePress
  • Medium 5.9
    CVE-2023-45066

    WordPress WP Ultimate Exporter Plugin <= 2.4.1 is vulnerable to Sensitive Data Exposure

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Smackcoders Export All Posts, Products, Orders, Refunds & Users.This issue affects Export All Posts, Products, Orders, Refunds & Users: from n/a through 2.4.1.

    Smackcoders Export All Posts, Products, Orders, Refunds & Users
  • Medium 5.3
    CVE-2023-45834

    WordPress Libsyn Publisher Hub Plugin <= 1.4.4 is vulnerable to Sensitive Data Exposure

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Libsyn Libsyn Publisher Hub.This issue affects Libsyn Publisher Hub: from n/a through 1.4.4.

    libsyn Libsyn Publisher Hub
  • Medium 5.3
    CVE-2023-46820

    WordPress Image Regenerate & Select Crop Plugin <= 7.3.0 is vulnerable to Sensitive Data Exposure

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Iulia Cazan Image Regenerate & Select Crop.This issue affects Image Regenerate & Select Crop: from n/a through 7.3.0.

    Iulia Cazan Image Regenerate & Select Crop
  • Medium 5.3
    CVE-2023-6401 Public exploit

    NotePad++ dbghelp.exe uncontrolled search path

    A vulnerability classified as problematic was found in NotePad++ up to 8.1. Affected by this vulnerability is an unknown functionality of the file dbghelp.exe. The manipulation leads to uncontrolled search path. An attack has to be approached locally. The ide…

  • Medium 6.5
    CVE-2023-48333

    WordPress Booster for WooCommerce Plugin <= 7.1.1 is vulnerable to Sensitive Data Exposure

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Pluggabl LLC Booster for WooCommerce.This issue affects Booster for WooCommerce: from n/a through 7.1.1.

    Pluggabl Booster for WooCommerce Web / CMS
  • Medium 5.3
    CVE-2023-6136

    WordPress Debug Log Manager Plugin <= 2.3.0 is vulnerable to Sensitive Data Exposure

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Bowo Debug Log Manager.This issue affects Debug Log Manager: from n/a through 2.3.0.

    Bowo Debug Log Manager
  • Low 3.7
    CVE-2023-37867

    WordPress Yet Another Stars Rating Plugin <= 3.3.8 is vulnerable to Race Condition

    Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in YetAnotherStarsRating.Com YASR – Yet Another Star Rating Plugin for WordPress.This issue affects YASR – Yet Another Star Rating Plugin for WordPress: from n/a through 3.3.8.

    YetAnotherStarsRating.com YASR – Yet Another Star Rating Plugin for WordPress Web / CMS
  • High 7.6
    CVE-2023-48742

    WordPress License Manager for WooCommerce Plugin <= 2.2.10 is vulnerable to SQL Injection

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LicenseManager License Manager for WooCommerce license-manager-for-woocommerce allows SQL Injection.This issue affects License Manager for WooCommerce: from …

    LicenseManager License Manager for WooCommerce Web / CMS