CVE-2023-38399

CVE-2023-38399 concerns a Local File Inclusion (path traversal) in WordPress plugin Phlox Portfolio by Averta. The vulnerability affects Phlox Portfolio versions up to 2.3.1 and is exploitable without authentication due to improper limitation of a pathname to a restricted directory. Patchstack an...

CVE-2023-37888

CVE-2023-37888 affects the WordPress plugin Shortcodes and extra features for Phlox theme . It is a Path Traversal (PHP Local File Inclusion) vulnerability that allows unauthenticated attackers to include local files. Affected versions are up to and including 2.14.0; the vendor/maintainer fixed i...

CVE-2023-37389

CVE-2023-37389 relates to SAASPROJECT Booking Package Plugin for WordPress, where versions 1.5.98 and earlier suffer an unauthenticated privilege escalation due to improper privilege management. The Patchstack entry confirms the vulnerable component and the root cause as Privilege Escalation with...

CVE-2023-37385

CVE-2023-37385 affects Stylemixthemes Consulting (WordPress plugin/theme) up to version 6.5.6. The issue is an improper pathname restriction leading to PHP Local File Inclusion (path traversal). Fixed in 6.5.7. CVSS v3.1 base score 7.3 (HIGH); attack vector NETWORK, no user interaction required. ...

CVE-2023-35881

The CVE-2023-35881 vulnerability affects the WooCommerce One Page Checkout WordPress plugin, specifically versions

CVE-2023-34186

CVE-2023-34186 affects the WordPress plugin Headless CMS (older:

CVE-2023-33321

CVE-2023-33321 is a confirmed vulnerability in the WordPress plugin EventPrime (Metagauss) affecting versions

CVE-2023-33310

CVE-2023-33310 affects Unite Gallery Lite for WordPress (

CVE-2023-32297

CVE-2023-32297 affects WordPress LWS Affiliation plugin versions up to 2.2.6. The issue is an improper limitation of a pathname to a restricted directory (Path Traversal) allowing PHP Local File Inclusion. Impact is described as high for confidentiality, integrity, and availability in the CVE rec...

CVE-2023-32244

The Woodmart Core WordPress plugin (versions n/a through 1.0.36 ) is vulnerable to an Improper Privilege Management issue. This flaw allows for Privilege Escalation , enabling an unauthenticated attacker to gain unauthorized access. The vulnerability has a CVSS score of 9.8 and is classified unde...

CVE-2023-32129

CVE-2023-32129 : Editorialmag WordPress theme contains a Missing Authorization weakness in Editorialmag (

CVE-2023-32110

CVE-2023-32110 describes a local file inclusion vulnerability in the WordPress theme JupiterX (≤ 3.0.0). The issue arises from improper pathname limitation in the theme, enabling PHP Local File Inclusion. Public documentation across connected sources confirms affected version range (n/a through 3...

CVE-2023-26526

CVE-2023-26526 affects WordPress Bookly plugin versions =21.8 to remediate.

CVE-2023-26009

Improper Privilege Management vulnerability in Favethemes Houzez Login Register allows Privilege Escalation.This issue affects Houzez Login Register: from n/a through 2.6.3...

CVE-2023-25701

CVE-2023-25701 is a WordPress WatchTowerHQ plugin vulnerability (WatchTowerHQ

CVE-2023-25444

CVE-2023-25444 affects the WordPress plugin JS Help Desk – Best Help Desk & Support Plugin (versions

CVE-2023-25050

The Shortcodes Ultimate WordPress plugin (versions through 5.12.6 ) is vulnerable to an Absolute Path Traversal vulnerability. This flaw allows an attacker with Contributor privileges to perform an Arbitrary File Download , potentially exposing sensitive data. The root cause is an improper limita...

CVE-2023-24379

CVE-2023-24379: Path traversal (Local File Inclusion) in WordPress plugin Landing Page Builder – Free Landing Page Templates (Web-Settler) up to version 3.1.9.9. Root cause is improper pathname limitation, enabling retrieval of restricted files via crafted input. Affected product/version details ...

CVE-2023-23990

CVE-2023-23990 : WordPress plugin “Redirection for Contact Form 7” (wpcf7-redirect) has an improper Privilege Management vulnerability that enables Privilege Escalation. Affected versions are

CVE-2023-23988

CVE-2023-23988 affects the WordPress My Tickets plugin (versions <= 1.9.11). The issue is a Missing Authorization vulnerability, allowing unauthenticated users to bypass payment-related checks, potentially impacting the payment flow. The official Patchstack entry confirms the vulnerable softwa...