CVE-2023-37871

CVE-2023-37871: The WooCommerce GoCardless Gateway plugin (

CVE-2023-38513

CVE-2023-38513 affects WordPress Photo Engine (Media Organizer & Lightroom) plugin, specifically Jordy Meow Photo Engine via the Photo Engine/WPLR‑Sync component. It is an Authorization Bypass through a User‑Controlled Key (IDOR) vulnerability that can bypass access controls. Affected range: n/a ...

CVE-2023-41796

The Sunshine Photo Cart plugin for WordPress (Sunshine Photo Cart: Free Client Galleries for Photographers) is affected by CVE-2023-41796. Affected versions are before 3.0.0 and the root cause is Insecure Direct Object References (IDOR) caused by authorization bypass via a user-controlled key, en...

CVE-2023-46311 WordPress wpDiscuz Plugin <= 7.6.3 is vulnerable to Insecure Direct Object References (IDOR)

Authorization Bypass Through User-Controlled Key vulnerability in gVectors Team Comments – wpDiscuz.This issue affects Comments – wpDiscuz: from n/a through 7.6.3...

CVE-2023-46311

CVE-2023-46311 refers to the WordPress plugin wpDiscuz (Comments)

Path Traversal

org.apache.tiles: tiles-core is vulnerable to Path Traversal. The vulnerability is due to missing validation in the DefaultLocaleResolver.LOCALEKEY attribute set on the session while resolving XML definition files. This can lead to Server Side Request Forgery SSRF or XML External Entity Injection...

PT-2023-28096

Name of the Vulnerable Software and Affected Versions Sunshine Photo Cart: Free Client Galleries for Photographers versions prior to 3.0.0 Description The issue is related to an Authorization Bypass Through User-Controlled Key vulnerability. This allows for unauthorized access, potentially leadin...

PT-2023-26490

Name of the Vulnerable Software and Affected Versions Jordy Meow Photo Engine Media Organizer & Lightroom versions n/a through 6.2.5 Description The issue is related to an Authorization Bypass Through User-Controlled Key vulnerability. This vulnerability allows for unauthorized access. No...

PT-2023-26151

Name of the Vulnerable Software and Affected Versions WooCommerce GoCardless versions 2.5.6 and earlier Description The issue is related to an Authorization Bypass Through User-Controlled Key vulnerability in WooCommerce GoCardless. Recommendations For versions 2.5.6 and earlier, update to a...

CVE-2023-35914: Authorization Bypass Through User-Controlled Key

Authorization Bypass Through User-Controlled Key vulnerability in WooCommerce Woo Subscriptions.This issue affects Woo Subscriptions: from n/a through 5.1.2...

CVE-2023-41796: Authorization Bypass Through User-Controlled Key

Authorization Bypass Through User-Controlled Key vulnerability in WP Sunshine Sunshine Photo Cart: Free Client Galleries for Photographers.This issue affects Sunshine Photo Cart: Free Client Galleries for Photographers: from n/a before 3.0.0...

CVE-2023-35916: Authorization Bypass Through User-Controlled Key

Authorization Bypass Through User-Controlled Key vulnerability in Automattic WooPayments – Fully Integrated Solution Built and Supported by Woo.This issue affects WooPayments – Fully Integrated Solution Built and Supported by Woo: from n/a through 5.9.0...

CVE-2023-35876: Authorization Bypass Through User-Controlled Key

Authorization Bypass Through User-Controlled Key vulnerability in WooCommerce WooCommerce Square.This issue affects WooCommerce Square: from n/a through 3.8.1...

CVE-2023-37871: Authorization Bypass Through User-Controlled Key

Authorization Bypass Through User-Controlled Key vulnerability in WooCommerce GoCardless.This issue affects GoCardless: from n/a through 2.5.6...

CVE-2023-38513: Authorization Bypass Through User-Controlled Key

Authorization Bypass Through User-Controlled Key vulnerability in Jordy Meow Photo Engine Media Organizer & Lightroom.This issue affects Photo Engine Media Organizer & Lightroom: from n/a through 6.2.5...

CVE-2023-46311: Authorization Bypass Through User-Controlled Key

Authorization Bypass Through User-Controlled Key vulnerability in gVectors Team Comments – wpDiscuz.This issue affects Comments – wpDiscuz: from n/a through 7.6.3...

CVE-2023-36520: Authorization Bypass Through User-Controlled Key

Authorization Bypass Through User-Controlled Key vulnerability in MarketingFire Editorial Calendar.This issue affects Editorial Calendar: from n/a through 3.7.12...

PT-2023-25607 · Unknown · Marketingfire Editorial Calendar

Name of the Vulnerable Software and Affected Versions: MarketingFire Editorial Calendar versions 3.7.12 and earlier Description: The issue is related to an Authorization Bypass Through User-Controlled Key vulnerability in MarketingFire Editorial Calendar. Recommendations: For versions 3.7.12 and...

PT-2023-25379 · Woocommerce · Woocommerce Subscriptions

Name of the Vulnerable Software and Affected Versions: WooCommerce Woo Subscriptions versions prior to 5.1.3 Description: The issue is related to an Authorization Bypass Through User-Controlled Key vulnerability. This vulnerability affects WooCommerce Woo Subscriptions, allowing unauthorized...

PT-2023-25381

Name of the Vulnerable Software and Affected Versions Automattic WooPayments – Fully Integrated Solution Built and Supported by Woo versions through 5.9.0 Description The issue is related to an Authorization Bypass Through User-Controlled Key vulnerability. This vulnerability affects the Automatt...