Ultimate Addons for Contact Form 7 < 3.1.29 - Admin+ Stored XSS

Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup PoC 1. Ensure Contact Form 7 is...

WordPress Audio Player with Playlist Ultimate Plugin <= 1.2.2 is vulnerable to Cross Site Scripting (XSS)

Software Audio Player with Playlist Ultimate Type Plugin Vulnerable versions = 1.2.2 Fixed in 1.3 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-38516 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID dabac0be2565 Credits Rio...

WordPress Ultimate Custom ScrollBar Plugin <= 1.1 is vulnerable to Cross Site Scripting (XSS)

Software Ultimate Custom ScrollBar Type Plugin Vulnerable versions = 1.1 Fixed in 1.2 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID 9b4f77bc482f Credits Rafie Muhammad Patchstack...

WordPress Ultimate LinkedIn Integration Plugin <= 0.9.0 is vulnerable to Cross Site Scripting (XSS)

Software Ultimate LinkedIn Integration Type Plugin Vulnerable versions = 0.9.0 Fixed in 1.0 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID fb8c20286a76 Credits Rafie Muhammad Patchstac...

WordPress BuddyForms Ultimate Member Plugin <= 1.3.7 is vulnerable to Cross Site Scripting (XSS)

Software BuddyForms Ultimate Member Type Plugin Vulnerable versions = 1.3.7 Fixed in 1.3.8 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID 72707a9ff4f8 Credits Rafie Muhammad Patchstack...

WordPress Ultimate Member Plugin < 2.6.1 CSRF Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:ultimatemember:ultimatemember"; ifdescription...

WordPress Ultimate Carousel For Divi Plugin < 4.5.1 is vulnerable to Cross Site Scripting (XSS)

Software Ultimate Carousel For Divi Type Plugin Vulnerable versions 4.5.1 Fixed in 4.5.1 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 62b9f7045643 Credits Rafie Muhammad Patchsta...

WordPress Ultimate Infinite Scroll Plugin Plugin <= 1.0.3 is vulnerable to Cross Site Scripting (XSS)

Software Ultimate Infinite Scroll Plugin Type Plugin Vulnerable versions = 1.0.3 Fixed in 1.0.4 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID e939817d24d9 Credits Rafie Muhammad...

WordPress Ultimate Post Kit – Addons For Elementor Plugin <= 3.6.3 is vulnerable to Cross Site Scripting (XSS)

Software Ultimate Post Kit – Addons For Elementor Type Plugin Vulnerable versions = 3.6.3 Fixed in 3.6.4 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 162050be8a2d Credits Rafie...

WordPress Shortcodes Ultimate Plugin <= 5.13.0 is vulnerable to Cross Site Scripting (XSS)

Software Shortcodes Ultimate Type Plugin Vulnerable versions = 5.13.0 Fixed in 5.13.1 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 568e2ac38f7b Credits Rafie Muhammad Patchstack...

WordPress B Blocks - The ultimate block collection Plugin < 1.7.8 is vulnerable to Cross Site Scripting (XSS)

Software B Blocks - The ultimate block collection Type Plugin Vulnerable versions 1.7.8 Fixed in 1.7.8 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 7a29938020aa Credits Rafie...

WordPress Ultimate Downloadable Products for WooCommerce Plugin < 1.3.1 is vulnerable to Cross Site Scripting (XSS)

Software Ultimate Downloadable Products for WooCommerce Type Plugin Vulnerable versions 1.3.1 Fixed in 1.3.1 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID c1f9e8d2a5cc Credits Raf...

WordPress Ultimate Blocks – Gutenberg Blocks Plugin Plugin <= 3.0.0 is vulnerable to Cross Site Scripting (XSS)

Software Ultimate Blocks – Gutenberg Blocks Plugin Type Plugin Vulnerable versions = 3.0.0 Fixed in 3.0.1 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 3f338cd9f3f6 Credits Rafie...

WordPress Ultimate Widgets Light Plugin <= 1.5.9.4 is vulnerable to Cross Site Scripting (XSS)

Software Ultimate Widgets Light Type Plugin Vulnerable versions = 1.5.9.4 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 4e4e4e84fe6c Credits Rafie Muhammad Patchstack...

WordPress Ultimate Gutenberg – Custom Block Templates Plugin <= 2.5.1 is vulnerable to Cross Site Scripting (XSS)

Software Ultimate Gutenberg – Custom Block Templates Type Plugin Vulnerable versions = 2.5.1 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 729999fffaff Credits Rafie...

CVE-2023-31216

Cross-Site Request Forgery CSRF vulnerability in Ultimate Member plugin = 2.6.0 versions...

Cross site request forgery (csrf)

Cross-Site Request Forgery CSRF vulnerability in Ultimate Member plugin = 2.6.0 versions...

CVE-2023-31216 WordPress Ultimate Member Plugin <= 2.6.0 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Ultimate Member plugin = 2.6.0 versions...

CVE-2023-31216 WordPress Ultimate Member Plugin <= 2.6.0 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Ultimate Member plugin = 2.6.0 versions...

CVE-2023-31216

CVE-2023-31216 affects the WordPress Ultimate Member plugin up to version 2.6.0 and is a Cross-Site Request Forgery (CSRF) vulnerability. The NVD entry lists a high impact (CVSSv3.1: 8.8 HIGH) affecting confidentiality, integrity, and availability, while Patchstack and related sources describe a ...