CVE-2023-41237

CVE-2023-41237 stems from an unauthenticated, reflected Cross-Site Scripting (XSS) in the WordPress theme Everest Themes’ Arya Multipurpose Pro, versioned ≤ 1.0.8. Public writeups consistently describe it as an unauthenticated XSS issue, with the impact limited to data integrity and user interact...

CVE-2023-41235

CVE-2023-41235: Everest News Pro theme (WordPress) up to version 1.1.7 is vulnerable to unauthenticated reflected XSS. Root cause: improper handling of user-controlled input in the Everest News Pro theme, enabling reflected XSS payloads. Impact is stated as cross-site scripting with unauthenticat...

CVE-2023-41860

CVE-2023-41860 — Unauthenticated Cross-Site Scripting (XSS) in TravelMap WordPress plugin, affected versions <= 1.0.1. The root cause is an XSS flaw in TravelMap

CVE-2023-41868

CVE-2023-41868 : An unauthenticated reflected XSS vulnerability affects the WordPress StagTools (Codestag) plugin = 2.3.8).

CVE-2023-40601

CVE-2023-40601 concerns the WordPress plugin Estatik Mortgage Calculator (<= 2.0.7 in initial sources; Patchstack references

CVE-2023-40196 WordPress ImageRecycle pdf & image compression Plugin <= 3.1.11 is vulnerable to Cross Site Scripting (XSS)

Unauth. Reflected Cross-Site Scripting XSS vulnerability in ImageRecycle ImageRecycle pdf & image compression plugin = 3.1.11 versions...

CVE-2023-31220

CVE-2023-31220 is an unauthenticated reflected XSS in the WordPress WP Categories Widget plugin (

CVE-2023-39918

CVE-2023-39918 affects the SAASPROJECT Booking Package WordPress plugin (versions

CVE-2023-25453

CVE-2023-25453 affects the WordPress Tables plugin (wptables) for WordPress, vulnerable in versions

CVE-2023-34176

CVE-2023-34176 affects the Chilexpress Woo Oficial WordPress plugin (

Hardcoded credentials

Netmaker makes networks with WireGuard. Prior to versions 0.17.1 and 0.18.6, hardcoded DNS key usage has been found in Netmaker allowing unauth users to interact with DNS API endpoints. The issue is patched in 0.17.1 and fixed in 0.18.6. If users are using 0.17.1, they should run docker pull...

CVE-2023-32509

CVE-2023-32509: Unauthenticated reflected XSS in WordPress plugin Order Your Posts Manually (

CVE-2023-26530

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Paul Kehrer Updraft plugin = 0.6.1 versions...

Cross site scripting

Unauth. Reflected Cross-Site Scripting XSS vulnerability in AdFoxly AdFoxly – Ad Manager, AdSense Ads & Ads.Txt plugin = 1.8.5 versions...

CVE-2023-30481

CVE-2023-30481 affects the WordPress plugin AGP Font Awesome Collection, version

CVE-2023-24413 WordPress wordpress vertical image slider plugin Plugin <= 1.2.16 is vulnerable to Cross Site Scripting (XSS)

Unauth. Reflected Cross-Site Scripting XSS vulnerability in I Thirteen Web Solution WordPress vertical image slider plugin = 1.2.16 versions...

Cross site scripting

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Everest themes Mocho Blog theme = 1.0.4 versions...

CVE-2023-36686

CartFlows Pro (WordPress) vulnerability CVE-2023-36686 is an unauthenticated, reflected XSS affecting versions = 1.11.12 to remediate the flaw. No exploitation details are provided in the sources; in-the-wild exploit status is not confirmed within the supplied documents.

CVE-2023-37873

CVE-2023-37873 : Unauthenticated Reflected Cross-Site Scripting in the WordPress plugin WooCommerce Ship to Multiple Addresses (aka Shipping Multiple Addresses) for WooCommerce, affected versions

CVE-2023-37894

CVE-2023-37894 affects RadiusTheme Variation Images Gallery for WooCommerce (WordPress plugin) versions = 2.3.4 mitigates the vulnerability. The vulnerability details specify that exploitation does not require authentication and can be triggered via reflected input in the affected gallery feature...