CVE-2023-40206

Summary: CVE-2023-40206 is an authenticated stored XSS vulnerability in the hwk-fr WP 404 Auto Redirect to Similar Post plugin (

CVE-2023-37393

CVE-2023-37393 is a stored XSS vulnerability in the WordPress plugin Atarim Visual Website Collaboration, Feedback & Project Management – Atarim (versions 3.9.3 (Patchstack notes fixed in 3.9.4). If upgrading is not immediately possible, apply mitigations per vendor guidance and monitor for upda...

CVE-2023-37393 WordPress Atarim Plugin <= 3.9.3 is vulnerable to Cross Site Scripting (XSS)

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Atarim Visual Website Collaboration, Feedback & Project Management – Atarim plugin = 3.9.3 versions...

CVE-2023-39987

CVE-2023-39987 is an authenticated stored XSS in the WordPress wSecure Lite plugin (

CVE-2023-36382

CVE-2023-36382 corresponds to an authenticated Stored Cross-Site Scripting (XSS) vulnerability in the WordPress plugin Jeffrey-WP Media Library Categories (versions ≤ 2.0.0). The issue arises from an input/output handling flaw in the plugin’s category functionality, enabling an admin+ caller to i...

CVE-2023-38476

CVE-2023-38476 : Auth. (admin+) Stored XSS in the WordPress plugin “SuiteDash Direct Login” for SuiteDash :: ONE Dashboard Client Portal, affected

PoC Exploit Released for Critical VMware Aria's SSH Auth Bypass Vulnerability

Proof-of-concept PoC exploit code has been made available for a recently disclosed and patched critical flaw impacting VMware Aria Operations for Networks formerly vRealize Network Insight. The flaw, tracked as CVE-2023-34039, is rated 9.8 out of a maximum of 10 for severity and has been describe...

CVE-2023-34011 WordPress ShopConstruct Plugin <= 1.1.2 is vulnerable to Cross Site Scripting (XSS)

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in ShopConstruct plugin = 1.1.2 versions...

CVE-2023-25042

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Liam Gladdy Storm Consultancy oAuth Twitter Feed for Developers plugin = 2.3.0 versions...

CVE-2023-37986

CVE-2023-37986 affects the miniOrange YourMembership Single Sign On (YM SSO) Login WordPress plugin, versions

CVE-2023-25488

CVE-2023-25488 applies to the WordPress plugin WP Default Feature Image . The connected sources describe a Stored Cross-Site Scripting (XSS) vulnerability that affects versions up to and including 1.0.1.1 . The root cause is an input/processing flaw in the plugin’s default feature image handling ...

CVE-2023-25044

CVE-2023-25044 affects the WordPress plugin Sumo Social Share Boost (versions

CVE-2023-24412

CVE-2023-24412 describes a stored XSS vulnerability in the Web-Settler Image Social Feed WordPress plugin up to version 1.7.6, requiring admin+ authentication to exploit. The issue is associated with the Image Social Feed/“add-instagram” plugin and is documented across multiple sources (NVD/Red H...

CVE-2023-25477

CVE-2023-25477 is a stored XSS in the WordPress plugin Yotuwp Video Gallery (versions

CVE-2023-35094

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Julien Berthelot / MPEmbed WP Matterport Shortcode plugin = 2.1.4 versions...

Cross site scripting

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Julien Berthelot / MPEmbed WP Matterport Shortcode plugin = 2.1.4 versions...

CVE-2023-27621

CVE-2023-27621 affects the WordPress Livestream Notice plugin (MrDemonWolf Livestream Notice) with versions

CVE-2023-24401

CVE-2023-24401 is a Stored XSS vulnerability in the WordPress plugin Davidsword Mobile Call Now & Map Buttons (versions

CVE-2023-28415

The CVE-2023-28415 entry concerns the WordPress Side Cart Woocommerce (Ajax) plugin (Admin+ stored XSS). Affected versions are

CVE-2023-28692 WordPress WP Abstracts Plugin <= 2.6.3 is vulnerable to Cross Site Scripting (XSS)

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Kevon Adonis WP Abstracts plugin = 2.6.3 versions...