CVEs published in June 2023
2,445 vulnerabilities, 292 critical, 16 exploited.
- wpmet metform elementor contact form builder, roxnor metform – contact form, survey, quiz, & custom form builder for elementor +1 moreMetform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via 'mf_payment_status' shortcode4.3 Medium
- pluginus wordpress currency switcher professional, realmag777 wpcs – wordpress currency switcher professional +1 moreWPCS – WordPress Currency Switcher Professional <= 1.1.9 - Missing Authorization to Arbitrary Custom Drop-Down Currency Switcher Editing4.3 Medium
- plainware locatoraid, locatoraid store locator +1 moreLocatoraid Store Locator <= 3.9.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode5.4 Medium
- wpdeveloper essential blocks, wpdevteam gutenberg essential blocks – page builder for gutenberg blocks & patterns +1 moreEssential Blocks <= 4.0.6 - Cross-Site Request Forgery via save4.3 Medium
- mikewire rocksolid announcement & notification banner – bulletin, bulletin announcement \& notification banner - bulletin +1 moreAnnouncement & Notification Banner – Bulletin <= 3.6.0 - Missing Authorization Checks6.3 Medium
- i13websolution wordpress vertical image slider, nik00726 vertical image slider +1 morewordpress vertical image slider plugin <= 1.2.16 - Reflected Cross-Site Scripting6.1 Medium
- weavertheme weaver show postsWeaver Show Posts <= 1.6 - Authenticated(Contributor+) Stored Cross-Site Scripting via Display Name6.4 Medium
- wpmet metform elementor contact form builder, roxnor metform – contact form, survey, quiz, & custom form builder for elementor +1 moreMetform Elementor Contact Form Builder <= 3.3.0 - Unauthenticated CSV Injection8.3 High
- ooohboi steroids for elementor project steroids for elementor, sagarpatel124 ooohboi steroids for elementor +1 moreOoohBoi Steroids for Elementor <= 2.1.4 - Missing Authorization leading to Authenticated (Subscriber+) Image Upload4.3 Medium
- expresstech quiz and survey master, quiz and survey master (qsm) – easy quiz and survey maker +1 moreQuiz And Survey Master <= 8.0.8 - Cross-Site Request Forgery to Arbitrary Media Deletion5.4 Medium
- wpeasycart wp easycart, levelfourstorefront shopping cart & ecommerce store +1 moreWP EasyCart <= 5.4.8 - Cross-Site Request Forgery via process_delete_product6.5 Medium
- pluginus wordpress currency switcher professional, realmag777 wpcs – wordpress currency switcher professional +1 moreWPCS – WordPress Currency Switcher Professional <= 1.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- staxwp stax, stax addons for elementor +1 moreElementor Addons, Widgets and Enhancements – Stax <= 1.4.3 - Cross-Site Request Forgery via toggle_widget4.3 Medium
- pluginus wordpress currency switcher, realmag777 wpcs – wordpress currency switcher professional +1 moreWPCS – WordPress Currency Switcher Professional <= 1.1.9 - Missing Authorization to Arbitrary Custom Drop-Down Currency Switcher Deletion4.3 Medium
- mikewire rocksolid announcement & notification banner – bulletin, bulletin announcement \& notification banner - bulletin +1 moreAnnouncement & Notification Banner – Bulletin <= 3.7.0 - Cross-Site Request Forgery6.3 Medium
- plainware shiftcontroller, shiftcontroller employee shift scheduling +1 moreShiftController Employee Shift Scheduling <= 4.9.25 - Reflected Cross-Site Scripting via Query String6.1 Medium
- wpwax directorist, directorist: ai-powered business directory, listings & classified ads +1 moreDirectorist <= 7.5.4 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Post Deletion in listing_task6.5 Medium
- wclovers woocommerce multivendor marketplace, wcfm – multivendor marketplace rest api for woocommerce +1 moreWooCommerce Multivendor Marketplace – REST API <= 1.5.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Order/Order Note Disclosure, Order Note Addition via REST API4.3 Medium
- niteothemes cmp, niteo cmp – coming soon & maintenance plugin by niteothemes +1 moreCMP – Coming Soon & Maintenance <= 4.1.7 - Maintenance Mode Bypass5.3 Medium
- wickedplugins wicked folders, wicked folders – folder organizer for pages, posts, and custom post types +1 moreWicked Folders <= 2.18.16 - Cross-Site Request Forgery via ajax_save_sort_order5.4 Medium
- wpfastestcache wp fastest cache, emrevona wp fastest cache – wordpress cache plugin +1 moreWP Fastest Cache <= 1.1.2 - Missing Authorization to Cache Deletion4.3 Medium
- wpmet metform elementor contact form builder, roxnor metform – contact form, survey, quiz, & custom form builder for elementor +1 moreMetform Elementor Contact Form Builder <= 3.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via mf_first_name shortcode5.4 Medium
- iptanus wordpress file upload, wordpress file upload pro, nickboss iptanus file upload +2 moreWordPress File Upload / WordPress File Upload Pro <= 4.19.1 - Authenticated (Administrator+) Path Traversal4.9 Medium
- wpdirectorykit wp directory kitWP Directory Kit <= 1.2.2 - Missing Authorization to Plugin Installation, Settings Change/Delete, Demo Import, Directory Kit Deletion via wdk_public_action6.5 Medium
- wpdeveloper essential blocks, wpdevteam gutenberg essential blocks – page builder for gutenberg blocks & patterns +1 moreEssential Blocks <= 4.0.6 - Missing Authorization via templates4.3 Medium
- codename065 download managerDownload Manager <= 3.2.70 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- wpdeveloper essential blocks, wpdevteam gutenberg essential blocks – page builder for gutenberg blocks & patterns +1 moreEssential Blocks <= 4.0.6 - Missing Authorization via template_count4.3 Medium
- yudiz wp replicate postWP Replicate Post <= 4.0.2 - Authenticated (Contributor+) SQL Injection8.8 High
- staxwp stax, stax addons for elementor +1 moreElementor Addons, Widgets and Enhancements – Stax <= 1.4.3 - Missing Authorization in toggle_widget4.3 Medium
- fibosearch, damian-gora fibosearch – ajax search for woocommerce +1 moreThe FiboSearch - AJAX Search for WooCommerce plugin for WordPress is vulnerable to Stored Cross...4.4 Medium
- wpmet metform elementor contact form builder, roxnor metform – contact form, survey, quiz, & custom form builder for elementor +1 moreMetform Elementor Contact Form Builder <= 3.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via mf_thankyou shortcode4.9 Medium
- wpmet metform elementor contact form builder, roxnor metform – contact form, survey, quiz, & custom form builder for elementor +1 moreMetform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via mf_last_name shortcode4.3 Medium
- psdtowpservice ultimate addons for contact form 7The Ultimate Addons for Contact Form 7 plugin for WordPress is vulnerable to SQL Injection via...8.8 High
- wpmet metform elementor contact form builder, roxnor metform – contact form, survey, quiz, & custom form builder for elementor +1 moreMetform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via mf_thankyou shortcode6.5 Medium
- cyberlord92 active directory integration / ldap integration, miniorange active directory integration \/ ldap integration +1 moreActive Directory Integration / LDAP Integration <= 4.1.4 - Cross-Site Request Forgery to SQL Injection3.1 Low
- gvectors wpforo forumwpForo Forum <= 2.1.7 - Authenticated (Subscriber+) Local File Include, Server-Side Request Forgery, and PHAR Deserialization via file_get_contents8.8 High
- jetmonsters getwid – gutenberg blocks, motopress getwid +1 moreGetwid – Gutenberg Blocks <= 1.8.3 - Improper Authorization via get_remote_templates REST endpoint4.3 Medium
- pixelyoursite, pixelyoursite pro, pro – your smart pixel (tag) manager +1 more +3 morePixelYourSite <= 9.3.6 and PixelYourSite Pro <= 9.6.1 - Authenticated (Administrator+) Stored Cross-Site Scripting4.4 Medium
- getshieldsecurity shield security, paultgoodchild shield: blocks bots, protects users, and prevents security breaches +1 moreShield Security <= 17.0.17 - Missing Authorization4.3 Medium
- expresstech quiz and survey master, quiz and survey master (qsm) – easy quiz and survey maker +1 moreQuiz And Survey Master <= 8.0.8 - Unauthenticated Arbitrary Media Deletion7.2 High
- wpmet metform elementor contact form builder, roxnor metform – contact form, survey, quiz, & custom form builder for elementor +1 moreMetform Elementor Contact Form Builder <= 3.3.0 - Missing Authorization6.5 Medium
- weavertheme weaver xtreme theme, wpweaver weaver xtreme +1 moreWeaver Xtreme Theme <= 5.0.7 - Authenticated(Contributor+) Stored Cross-Site Scripting via Display Name6.4 Medium
- nik00726 photo gallery slideshow & masonry tiled gallery, i13websolution photo gallery slideshow \& masonry tiled gallery +1 morePhoto Gallery Slideshow & Masonry Tiled Gallery <= 1.0.13 - Reflected Cross-Site Scripting6.1 Medium
- webfactory under constructionUnder Construction <= 3.96 - Cross-Site Request Forgery via admin_action_install_weglot4.3 Medium
- supsystic easy google mapsEasy Google Maps <= 1.11.7 - Cross-Site Request Forgery via AJAX action5.4 Medium
- advanced-woo-search advanced woo search, mihail-barinov advanced woo search – product search for woocommerce +1 moreAdvanced Woo Search <= 2.77 - Authenticated (Admin+) Stored Cross-Site Scripting4.4 Medium
- blubrry powerpress, powerpress podcasting plugin by blubrry +1 morePowerPress <= 10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode5.4 Medium
- i13websolution team circle image slider with lightboxTeam Circle Image Slider With Lightbox <= 1.0.17 - Reflected Cross-Site Scripting6.1 Medium
- cyberlord92 active directory integration / ldap integration, miniorange active directory integration \/ ldap integration +1 moreActive Directory Integration / LDAP Integration <= 4.1.4 - Authenticated (Administrator+) SQL Injection7.2 High
- vcita online booking & scheduling calendar for wordpress by vcita, online booking \& scheduling calendar +1 moreOnline Booking & Scheduling Calendar for WordPress by vcita <= 4.4.6 - Missing Authorization to Settings Update and Arbitrary File Upload5.4 Medium
- Show moreLoading…