CVE-2023-48763

CVE-2023-48763 – JetFormBuilder Content Injection : An unauthenticated attacker can inject content via improper neutralization of script-related HTML tags in JetFormBuilder. Affected: WordPress JetFormBuilder versions up to 3.1.4. Root cause: content injection vulnerability (XSS-like) in dynamic ...

CVE-2022-45852

CVE-2022-45852 is a path traversal vulnerability in the WordPress WP-FormAssembly plugin affecting versions n/a through 2.0.5. It arises from improper limitation of a pathname to a restricted directory, allowing traversal to sensitive files. Documented impacts include (per sources) potential unau...

CVE-2023-50885

CVE-2023-50885 affects Store Locator WordPress (AGILESTORE LOCATOR) plugin for WordPress, with versions up to 1.4.14. It is an improper limitation of a pathname to a restricted directory (path traversal) vulnerability that can enable arbitrary file deletion. Red Hat and other sources corroborate ...

CVE-2023-4234

CVE-2023-4234 affects ofono (Open Source Telephony on Linux). The vulnerability is a stack-based buffer overflow triggered in decode_submit_report() during SMS decoding, with a bound check missing for the memcpy length in that function. Attack surface is plausible from a compromised modem, malici...

CVE-2023-51418

CVE-2023-51418 affects the JVM Gutenberg Rich Text Icons WordPress plugin. Public docs show a Missing Authorization vulnerability that enables authenticated users to perform unauthorized actions, including directory traversal leading to Arbitrary File Deletion or similar file operations, impactin...

CVE-2023-51500

CVE-2023-51500 affects Undsgn Uncode Core (

CVE-2023-44227

CVE-2023-44227 affects WordPress plugin Simple File List (Mitchell Bennis) up to version 6.1.9. Root cause: Missing/insufficient authorization controls allow unauthenticated users to delete arbitrary files via the plugin’s deletion functionality, enabling potential denial of service or data loss....

CVE-2023-36505

CVE-2023-36505 affects the Ninja Forms Contact Form WordPress plugin (versions

CVE-2023-45000

CVE-2023-45000 is a Missing Authorization vulnerability affecting LiteSpeed Cache (WordPress) up to version 5.7, allowing unauthorized access via the API. The available documents confirm the issue and affected range but do not provide concrete exploitation details, affected sub-components, or a c...

CVE-2023-40000

The LiteSpeed Cache plugin for WordPress (versions prior to 5.7.0.1 ) contains a Stored Cross-Site Scripting (XSS) vulnerability due to improper input sanitization in the update_cdn_status function. Unauthenticated attackers can send a POST request to the /wp-json/litespeed/v1/cdn_status endpoint...

CVE-2023-52144

CVE-2023-52144 is a Path Traversal in the RexTheme Product Feed Manager (WordPress plugin). Connected Red Hat/ENISA/NVD entries confirm this as an Improper Limitation of a Pathname to a Restricted Directory affecting RexTheme Product Feed Manager up to version 7.3.15. The Red Hat entry notes the ...

CVE-2024-1846

The Responsive Tabs WordPress plugin (versions

CVE-2024-2836

The Social Share, Social Login and Social Comments Plugin (also known as Super Socializer ) for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in versions prior to 7.13.64 . The root cause is the failure to properly sanitize and escape certain plugin settings before they are display...

CVE-2024-1712

The Carousel Slider WordPress plugin (versions before 2.2.7 ) is vulnerable to Stored Cross-Site Scripting (XSS) due to a failure to sanitize and escape certain settings. This flaw could allow high-privilege users, such as admins , to perform XSS attacks even when the unfiltered_html capability i...

CVE-2024-1746

The Testimonial Slider WordPress plugin (versions prior to 2.3.8 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the insufficient sanitization and escaping of certain plugin settings before they are rendered on pages. This flaw allows authenticated attackers with administ...

CVE-2024-1755

The NPS computy WordPress plugin (versions 2.7.5 and earlier ) is vulnerable to Cross-Site Request Forgery (CSRF) due to a lack of CSRF checks in certain areas. This flaw could allow an attacker to trick a logged-in user into performing unwanted actions, specifically including results deletion . ...

CVE-2024-1660

The Top Bar WordPress plugin before 3.0.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-1310

The WooCommerce WordPress plugin in versions before 8.6 is vulnerable to a Broken Access Control flaw. This vulnerability allows users with at least the contributor role to leak products they should not have access to, specifically private, draft, and trashed products . The issue was resolved in ...

CVE-2023-7201

The Everest Backup WordPress plugin (versions prior to 2.2.5 ) contains an arbitrary file upload vulnerability. The root cause is the plugin's failure to properly validate backup files being uploaded to the server. This allows high-privilege users, such as administrators, to upload arbitrary file...

CVE-2023-6067

The WP User Profile Avatar WordPress plugin (versions 1.0.1 and earlier ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to validate and escape certain shortcode attributes before they are outputted back into a page or post where the shortcode is embedded. This...