5920 matches found
CVE-2023-47849
CVE-2023-47849 affects the BlossomThemes Email Newsletter WordPress plugin. The issue is a Missing Authorization / Broken Access Control in the bten_get_mailing_list workflow, allowing unauthenticated access to mailing list data for versions up to and including 2.2.4. The vulnerability’s CVSS v3....
CVE-2023-48286
CVE-2023-48286 concerns the WordPress Stripe Payments plugin (Accept Stripe Payments) ≤ 2.0.79, with a Missing Authorization/ Broken Access Control vulnerability due to incorrectly configured access controls. Public-facing unauthenticated users could potentially exploit the issue due to unauthent...
CVE-2023-48774
CVE-2023-48774 affects the WordPress IdeaPush plugin (versions
CVE-2023-48776
CVE-2023-48776 affects the WordPress canvasio3D Light plugin (
CVE-2023-48779
CVE-2023-48779 pertains to WordPress 360 Javascript Viewer (plugin) with Broken Access Control via Missing Authorization. Affected versions are
CVE-2023-49158
CVE-2023-49158 affects the WordPress plugin LadiApp (LadiPage) and permits Stored XSS due to improper input neutralization during web page generation. Affected: LadiApp versions up to 4.4. Root cause: inadequate sanitization of input when generating pages. Impact: stored cross-site scripting coul...
CVE-2023-49167
CVE-2023-49167 affects the WordPress Database for CF7 plugin (
CVE-2023-49192
CVE-2023-49192 concerns the WordPress plugin Enhanced Text Widget (Clever Widgets)
CVE-2023-49193
CVE-2023-49193 is a verifiable vulnerability in the WordPress plugin Social Pug (Hubbub Lite) : versions up to and including 1.30.0 allow a Missing Authorization / Broken Access Control condition. Unauthenticated users could exploit incorrectly configured access controls. The issue is publicly do...
CVE-2023-49754
CVE-2023-49754 concerns the WordPress plugin Bulk Edit Post Titles (
CVE-2023-49756
CVE-2023-49756 refers to WordPress Eventin plugin
CVE-2023-49755
CVE-2023-49755 affects WordPress plugin Elementor Timeline Widget (
CVE-2023-49757
CVE-2023-49757 concerns WordPress Awesome Support plugin in versions up to 6.1.10, with a Missing Authorization vulnerability due to incorrectly configured access control. Public disclosures and patch data indicate the issue is being addressed, with a fix released in version 6.1.11. Recommended r...
CVE-2023-49758
CVE-2023-49758 concerns the WordPress plugin WP Booking System. The issue is a Missing Authorization flaw in wpbs_save_calendar_data that allowed authenticated users (subscriber level and above) to save calendar data on affected versions. Vulnerable range:
CVE-2023-49817
CVE-2023-49817 affects the WordPress plugin Flexible Woocommerce Checkout Field Editor (
CVE-2023-49835
CVE-2023-49835 affects the WordPress plugin Post Duplicator (versions up to 2.31). The issue is described as a Missing Authorization / Broken Access Control vulnerability allowing unauthorized access due to incorrectly configured access control. The vulnerability and its CVE are corroborated by P...
CVE-2023-49848
CVE-2023-49848 is a missing/ broken authorization vulnerability in the WordPress Sharkdropship Dropshipping plugin for AliExpress, eBay, Amazon, Etsy (SharkDropship & Affiliate for AliExpress, etc.). Affected versions are up to 2.1.1; exploitation arises from an incorrectly configured access cont...
CVE-2023-49849
CVE-2023-49849 affects WordPress plugin Shortcoder (versions
CVE-2023-49850
CVE-2023-49850 – WordPress WP Simple HTML Sitemap : Affected plugin versions are ≤ 2.7. Root cause is broken access control due to missing authorization checks, allowing unauthenticated access to perform an unauthorized action. CVSS v3.1 base score is 5.3 (Medium) per Patchstack, and reports cons...