CVEs published in June 2023
2,445 vulnerabilities, 292 critical, 16 exploited.
- stylemixthemes ulisting, stylemix directory listings wordpress plugin – ulisting +1 moreuListing <= 1.6.6 - Missing Authorization9.8 Critical
- najeebmedia frontend file manager pluginFrontend File Manager <= 18.2 - Unauthenticated Content Injection5.8 Medium
- visual composer website builder, visualcomposer visual composer website builder +1 moreVisual Composer <= 26.0 - Multiple Cross-Site Scripting5.5 Medium
- rightpress woocommerce dynamic pricing and discountsWooCommerce Dynamic Pricing and Discounts <= 2.4.1 - Stored Cross-Site Scripting6.5 Medium
- pluginmirror wp quick frontend editor, labibahmed42 wp quick frontend editor – wordpress plugin +1 moreWP Quick FrontEnd Editor <= 5.5 - Authenticated Settings Change4.3 Medium
- wordable, wordable – export google docs to wordpress +1 moreWordable <= 3.1.1 - Authentication Bypass9.8 Critical
- webwizards b2bking, webwizardsdev b2bking — ultimate woocommerce b2b and wholesale plugin — wholesale prices, bulk order form & more +1 moreB2BKing <= 4.6.00 - Missing Authorization to Authenticated(Subscriber+) Price Modification6.5 Medium
- cridio listingproListingPro - WordPress Directory & Listing Theme < 2.6.1 - Sensitive Information Disclosure5.3 Medium
- codemiq wp html mail, haet email template designer – wp html mail +1 moreWP HTML Mail < 2.9.1 - HTML Injection6.1 Medium
- delete all comments project all comments, ganesh chandra delete all comments +1 moreDelete All Comments <= 2.0 - Arbitrary File Upload9.8 Critical
- najeebmedia frontend file manager pluginFrontend File Manager <= 18.2 - Authenticated Settings Change leading to Arbitrary File Upload9.9 Critical
- prettylinks pretty links, supercleanse prettylinks – affiliate links, link branding, link tracking, marketing and stripe payments plugin +1 morePretty Links <= 2.1.9 - Unauthenticated Stored Cross-Site Scripting via track_link7.2 High
- najeebmedia frontend file manager pluginFrontend File Manager <= 18.2 - Unauthenticated Stored Cross-Site Scripting7.2 High
- colorlib activello, newspaper x, cpothemes brilliance +12 more +14 moreEpsilon Framework Themes (Various Versions) - Unauthenticated Plugin Activation/Deactivation6.5 Medium
- delucks seoDELUCKS SEO < 2.1.8 - Stored Cross Site Scripting7.2 High
- magazine3 pwa for wp – progressive web apps made simple, pwa for wp \& amp +1 morePWA for WP & AMP < = 1.7.32 - Missing Authorization6.3 Medium
- kaliforms kali forms, wpchill kali forms — contact form & drag-and-drop builder +1 moreKali Forms <= 2.1.1 - Cross-Site Request Forgery8.8 High
- flothemes flo forms, flothemesplugins flo forms – easy drag & drop form builder +1 moreFlo Forms – Easy Drag & Drop Form Builder <= 1.0.35 - Options Change to Stored Cross-Site Scripting6.4 Medium
- ninjateam gdpr ccpa compliance & cookie consent banner, gpdr ccpa compliance support +1 moreGDPR CCPA Compliance Support <= 2.3 - PHP Object Injection9.8 Critical
- kaliforms kali forms, wpchill kali forms — contact form & drag-and-drop builder +1 moreKali Forms <= 2.1.1 - Missing Authorization to Settings Update7.1 High
- cridio listingproListingPro - WordPress Directory & Listing Theme < 2.6.1 - Arbitrary Plugin Installation, Activation and Deactivation9.8 Critical
- melapress wp activity logWP Activity Log <= 4.0.1 - Missing Authorization7.3 High
- wpforms contact form, smub contact form & smtp plugin for wordpress by pirateforms +1 moreContact Form & SMTP Plugin by PirateForms <= 2.5.1 - Unauthenticated HTML injection7.2 High
- xootix login & register customizer – popup | slider | inline | woocommerce, login\/signup popup +1 moreLogin/Signup Popup < 1.5 - Missing Authorization7.4 High
- inspireui mstore api, mstore api – create native android & ios apps on the cloud +1 moreMStore API <= 2.1.5 - Authentication Bypass9.8 Critical
- codemiq wp html mail, a3rev wp email template +1 moreWP HTML Mail < 2.2.11 - HTML injection5.4 Medium
- kaliforms kali forms, wpchill kali forms — contact form & drag-and-drop builder +1 moreKali Forms <= 2.1.1 - Unauthenticated Arbitrary Post Deletion8.6 High
- mooveagency gdpr cookie compliance, gdpr cookie compliance – cookie banner, cookie consent, cookie notice for ccpa, eu cookie law +1 moreGDPR Cookie Compliance <= 4.0.2 - Missing Authorization5.4 Medium
- eyecix jobsearch wp job boardJobSearch WP Job Board < = 1.8.1 - Missing Authorization on jobsearch_update_job_import_schedule_call() function4.3 Medium
- extendthemes materialis, mesmerize +1 moreMesmerize <= 1.6.89 & Materialis <= 1.0.172 - Authenticated Arbitrary Options Update8.8 High
- waseem senjer controlled admin accessControlled Admin Access < 1.5.6 - Privilege Escalation9.9 Critical
- najeebmedia frontend file manager pluginFrontend File Manager Plugin <= 18.2 - Unauthenticated Arbitrary Post Deletion6.5 Medium
- wpkube kiwi social share, social sharing plugin – kiwi +1 moreThe Kiwi Social Share plugin for WordPress is vulnerable to authorization bypass due to a missing...9.8 Critical
- eyecix jobsearch wp job boardJobSearch WP Job Board <= 1.8.1 - Missing Authorization to Arbitrary Options Update8.8 High
- wp-ecommerce easy wp smtp, smub easy wp smtp – wordpress smtp and email logs: gmail, office 365, outlook, custom smtp, and more +1 moreEasy WP SMTP <= 1.3.9 - Missing Authorization to Arbitrary Options Update9.8 Critical
- webdevocean wp quick frontend editor, labibahmed42 wp quick frontend editor – wordpress plugin +1 moreWP Quick FrontEnd Editor <= 5.5 - Reflected Cross-Site Scripting6.1 Medium
- najeebmedia frontend file manager pluginFrontend File Manager <= 18.2 - Unauthenticated Arbitrary File Download9.0 Critical
- stylemixthemes ulisting, stylemix directory listings wordpress plugin – ulisting +1 moreuListing <= 1.6.6 - Unauthenticated Arbitrary Post/Page Deletion9.1 Critical
- tabrisrp wps hide loginWPS Hide Login <= 1.5.4.2 - Hidden Login Page Location Disclosure5.3 Medium
- wpshopmart coming soon page & maintenance mode, coming soon page \& maintenance mode +1 moreComing Soon Page & Maintenance Mode <= 1.8.1 - Stored Cross Site Scripting7.2 High
- flying-press flyingpressFlyingPress <= 3.9.6 - Missing Authorization4.3 Medium
- legalweb wp dsgvo tools (gdpr), wp dsgvo tools +1 moreWP DSGVO Tools (GDPR) <= 3.1.23 - Unauthenticated Stored Cross-Site Scripting7.2 High
- nanbu welcart e-commerce, welcart e-commerce +1 moreWelcart e-Commerce < 2.2.8 - Missing Capabilities Check to Information Disclosure7.5 High
- theme-fusion avada, themefusion avada | website builder for wordpress & woocommerce +1 moreAvada <= 6.2.2 - Authenticated (Contributor+) Cross-Site Scripting6.4 Medium
- king-theme page builder kingcomposer, kingthemes page builder: kingcomposer – free drag and drop page builder by king-theme +1 morePage Builder: KingComposer < 2.9.4 - Stored Cross-Site Scripting5.5 Medium
- wpshopmart coming soon page & maintenance mode, coming soon page \& maintenance mode +1 moreComing Soon Page & Maintenance Mode <= 1.8.1 - Unauthenticated Settings Reset6.5 Medium
- magazine3 pwa for wp – progressive web apps made simple, pwa for wp \& amp +1 morePWA for WP & AMP <= 1.7.32 - Arbitrary File Upload8.8 High
- colorlib activello, bonkers, illdy +14 more +16 moreEpsilon Framework Themes (Various Versions) - Function Injection9.8 Critical
- plugin-planet user submitted posts, specialk user submitted posts – enable users to submit posts from the front end +1 moreUser Submitted Posts <= 20190312 - Unauthenticated Arbitrary File Upload9.8 Critical
- eyecix jobsearch wp job boardJobSearch WP Job Board <= 1.8.1 - Missing Authorization to Settings Change5.3 Medium
- Show moreLoading…