CVE-2023-49774

CVE-2023-49774 concerns the WordPress plugin WP Photo Album Plus (versions up to 8.5.02.005). The Red Hat/NVD entries describe an Information Exposure/Bypass issue where unauthenticated users could bypass login protection by manipulating IP-related behavior. PatchStack confirms the vulnerability ...

CVE-2023-49748

CVE-2023-49748 affects the WP Hide Login plugin (WordPress) up to version 1.9.11. The vulnerability is described as a Secret Login Page Location Disclosure on multisite installations, enabling exposure of login functionality due to ACLs not constraining access as intended. It has a low overall im...

CVE-2023-49741

CVE-2023-49741 affects the WordPress plugin Coming Soon and Maintenance mode (

CVE-2023-48753

CVE-2023-48753 covers a WordPress plugin issue in “Restricted Site Access” where IP address-based access control can be bypassed via IP spoofing. Affected plugin: Restricted Site Access (WordPress) up to and including version 7.4.1. The root cause is insufficient restriction of how IP information...

CVE-2023-48747

CVE-2023-48747 affects Booster for WooCommerce (WordPress plugin)

CVE-2023-48745

CVE-2023-48745 affects the WordPress plugin Captcha Code by WebFactory Ltd. It is caused by improper restriction of excessive authentication attempts, enabling a bypass of captcha protection. Affected versions are

CVE-2023-48335

The CVE-2023-48335 entry describes a vulnerability in the WordPress plugin Hide login page (versions up to 1.1.9) where an unauthenticated actor can access the login functionality due to ACL constraints being bypassed. The underlying issue is a location disclosure/bypass that exposes a login page...

CVE-2023-48318

CVE-2023-48318 is a CAPTCHA bypass vulnerability in WordPress plugin Contact Form Email (

CVE-2023-48285

CVE-2023-48285 affects the WordPress plugin Accept Stripe Payments (Stripe Payments) up to version 2.0.79. Root cause: improper neutralization of script-related HTML tags causing content injection (XSS) leading to potential code injection. Affected users could craft unauthenticated content inject...

CVE-2023-48271

CVE-2023-48271 affects WordPress Maspik – Spam Blacklist plugin (legacy

CVE-2023-47837

CVE-2023-47837 . Affected: WordPress ARMember plugin versions up to and including 4.0.10. Issue: Improper Privilege Management allowing Privilege Escalation for subscribers with low privileges. Root cause and impact as described in connected sources align on a membership plan bypass vulnerability...

CVE-2023-47663

CVE-2023-47663 affects the WordPress plugin Foyer (WordPress plugin: Foyer – Digital Signage for WordPress). The issue is Improper Neutralization of Script-Related HTML Tags, resulting in Content Injection (basic XSS). Affected versions are Foyer up to 1.7.5. The vulnerability requires at least C...

CVE-2023-47513

The CVE-2023-47513 entry concerns ARI Stream Quiz for WordPress (ARI Stream Quiz plugin). Affected software: ARI Stream Quiz versions up to and including 1.3.2. Root cause: Improper handling/neutralization of script-related HTML tags enabling content injection (Basic XSS). Impact: potential code ...

CVE-2024-5463

CVE-2024-5463 describes a buffer copy without input size checking (Classic Buffer Overflow) in the login component of Synology Camera Firmware. Affected: Synology Camera Firmware prior to 1.1.1-0383, specifically BC500 and TC500 models. Impact is limited to the login service, which may crash and ...

CVE-2024-4637

Slider Revolution for WordPress (revslider) versions up to and including 6.7.10 are affected by a stored XSS due to insufficient input sanitization and output escaping on Elementor wrapperid and zindex attributes. Exploitation requires authenticated access (Contributor+). Patch/mitigation exists ...

CVE-2023-47189

CVE-2023-47189 affects WordPress Defender Security plugin versions

CVE-2023-46630

CVE-2023-46630 affects WordPress Admin and Site Enhancements (ASE) plugin versions up to 5.7.1. The issue is an unauthenticated bypass of Password Protection Mode due to a flawed authentication flow (reported as bypass via the maybe_process_login path), allowing access to password-protected conte...

CVE-2023-46310

CVE-2023-46310 describes a Content Injection vulnerability in the WordPress plugin wpDiscuz (gVectors Team) affecting versions up to 7.6.10. The issue is due to improper neutralization of script-related HTML tags, enabling code injection via wpDiscuz content. Public sources in the connected docum...

CVE-2023-45009

CVE-2023-45009 is a CAPTCHA/Honeypot plugin vulnerability for WordPress Contact Form 7 (Captcha/Honeypot for Contact Form 7 by Forge12 Interactive GmbH). It allows bypass of authentication-related checks due to improper restriction of excessive authentication attempts in versions up to 1.11.3. Pu...

CVE-2023-5751

CVE-2023-5751 is described across multiple connected sources as affecting the CODESYS development system, with a local attacker of low privileges able to read and modify any user files and trigger a DoS in the working directory due to exposure of a resource to the wrong security sphere. The root ...