CVE-2023-41800

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in UniConsent UniConsent CMP for GDPR CPRA GPP TCF plugin = 1.4.2 versions...

CVE-2023-41731

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in I Thirteen Web Solution WordPress publish post email notification plugin = 1.0.2.2 versions...

PT-2023-28071 · I Thirteen Web Solution · I Thirteen Web Solution Wordpress Publish Post Email Notification Plugin

Name of the Vulnerable Software and Affected Versions: I Thirteen Web Solution WordPress publish post email notification plugin versions = 1.0.2.2 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin or higher privileges. Thi...

Pure Storage FlashBlade Security Vulnerability

Pure Storage FlashBlade is a consolidated storage platform for file and object workloads from U.S.-based Pure Storage. A security vulnerability exists in FlashBlade Purity that arises from a user with access to an administrative account on a FlashBlade that is configured with a snapshot schedule...

PT-2023-28073 · Yydevelopment · Back To The Top Button

Name of the Vulnerable Software and Affected Versions: YYDevelopment Back To The Top Button plugin versions = 2.1.5 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin or higher privileges. Recommendations: For YYDevelopment...

CVE-2023-41657

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Groundhogg Inc. HollerBox plugin = 2.3.2 versions...

CVE-2023-4505

The Staff / Employee Business Directory for Active Directory plugin for WordPress is vulnerable to LDAP Passback in versions up to, and including, 1.2.3. This is due to insufficient validation when changing the LDAP server. This makes it possible for authenticated attackers, with administrative...

CVE-2023-4506

The Active Directory Integration / LDAP Integration plugin for WordPress is vulnerable to LDAP Passback in versions up to, and including, 4.1.10. This is due to insufficient validation when changing the LDAP server. This makes it possible for authenticated attackers, with administrative access an...

CVE-2023-40677

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Gopi Ramasamy Vertical marquee plugin = 7.1 versions...

CVE-2023-40675

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in PluginOps Landing Page Builder plugin = 1.5.1.2 versions...

CVE-2023-40604

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Jes Madsen Cookies by JM plugin = 1.0 versions...

CVE-2023-27617

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in David F. Carr RSVPMaker plugin = 10.6.6 versions...

CVE-2023-25483

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Ankit Agarwal, Priyanshu Mittal Easy Coming Soon plugin = 2.3 versions...

CVE-2023-4502

The Translate WordPress with GTranslate WordPress plugin before 3.0.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisi...

PT-2023-28757 · Seacms · Seacms

Name of the Vulnerable Software and Affected Versions: Seacms versions up to v12.8 Description: A Cross-Site Request Forgery CSRF in admin manager.php allows attackers to arbitrarily add an admin account. Recommendations: For Seacms versions up to v12.8, update to a version later than v12.8 to...

PT-2023-28186 · Christoph Rado · Christoph Rado Cookie Notice & Consent Plugin

Name of the Vulnerable Software and Affected Versions: Christoph Rado Cookie Notice & Consent plugin versions prior to 1.7.0 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin or higher privileges. Recommendations: For...

CVE-2023-41179

A vulnerability in the 3rd party AV uninstaller module contained in Trend Micro Apex One on-prem and SaaS, Worry-Free Business Security and Worry-Free Business Security Services could allow an attacker to manipulate the module to execute arbitrary commands on an affected installation. Note that a...

VulnCheck KEV: CVE-2023-41179

Trend Micro Apex One and Worry-Free Business Security contain an unspecified vulnerability in the third-party anti-virus uninstaller that could allow an attacker to manipulate the module to conduct remote code execution. An attacker must first obtain administrative console access on the target...

PT-2023-5267

Name of the Vulnerable Software and Affected Versions Trend Micro Apex One on-prem and SaaS versions affected versions not specified Worry-Free Business Security versions affected versions not specified Worry-Free Business Security Services versions affected versions not specified Description A...

PT-2023-22494 · WordPress · Leyka

Name of the Vulnerable Software and Affected Versions: Leyka WordPress plugin versions prior to 3.30.4 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, for example in multisi...