CVEs published in October 2023
2,902 vulnerabilities, 370 critical, 18 exploited.
- strangerstudios paid memberships pro, paid memberships pro – content restriction, user registration, & paid subscriptions +1 morePaid Memberships Pro <= 2.4.2 - Cross-Site Request Forgery Bypass4.3 Medium
- nikeo huemanHueman <= 3.6.3 - Cross-Site Request Forgery Bypass4.3 Medium
- inisev social media share buttons & social sharing icons, ultimatelysocial social media share buttons \& social sharing icons +1 moreSocial Media Share Buttons & Social Sharing Icons <= 2.8.5 - Cross-Site Request Forgery4.3 Medium
- flippercode custom css-js-php, wpfactory custom css\, js \& php +1 moreCustom CSS, JS & PHP <= 2.0.7 - Cross-Site Request Forgery Bypass4.3 Medium
- pogidude magic action boxMagic Action Box <= 2.17.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- ad inserter project inserter, spacetime ad inserter – ad manager & adsense ads +1 moreAd Inserter <= 2.7.30 - Unauthenticated Sensitive Information Exposure via ai-debug-processing-fe5.3 Medium
- wpvivid migration\, backup\, staging, wpvividplugins wpvivid — backup, migration & staging +1 moreMigration, Backup, Staging – WPvivid <= 0.9.89 - Authenticated (Administrator+) Stored Cross-Site Scripting4.4 Medium
- cyr to lat project to lat, ivijanstefan cyr to lat enhanced +1 moreCyr to Lat <= 3.5 - Authenticated SQL Injection8.8 High
- armemberplugin armember, reputeinfosystems armember – membership plugin, content restriction, member levels, user profile & user signup +1 moreARMember Lite - Membership Plugin <= 4.0.16 - Authenticated (Administrator+) Stored Cross-Site Scripting4.4 Medium
- gopiplus horizontal scrolling announcementHorizontal scrolling announcement <= 9.2 - Authenticated (Subscriber+) SQL Injection via Shortcode8.8 High
- pluginus bear - woocommerce bulk editor and products manager professional, realmag777 bear – bulk editor and products manager professional for woocommerce by pluginus.net +1 moreBEAR <= 1.1.3.3 - Missing Authorization to Product Manipulation4.3 Medium
- gvectors wpdiscuz, advancedcoding comments – wpdiscuz +1 morewpDiscuz <= 7.6.3 - Insecure Direct Object Reference to Comment Rating Increase/Decrease5.3 Medium
- orangelab imagemagick engineImageMagick Engine <= 1.7.5 - Cross-Site Request Forgery to Remote Command Execution8.8 High
- formforall, formforall contact form form for all – easy to use, fast, 37 languages. +1 moreContact form Form For All <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- wpdeveloper essential blocks, wpdevteam essential blocks pro, gutenberg essential blocks – page builder for gutenberg blocks & patterns +2 moreEssential Blocks <= 4.2.0 - Unauthenticated PHP Object Injection via queries8.1 High
- quantumcloud wpbot, wpbot – ai chatbot for live support, lead generation, ai services +1 moreAI ChatBot <= 4.8.9 and 4.9.2 - Missing Authorization on AJAX actions5.3 Medium
- pluginus bear - woocommerce bulk editor and products manager professional, realmag777 bear – bulk editor and products manager professional for woocommerce by pluginus.net +1 moreBEAR <= 1.1.3.3 - Cross-Site Request Forgery to Product Deletion5.4 Medium
- brianjessee coupon creatorCoupon Creator <= 3.1 - Cross-Site Request Forgery Bypass4.3 Medium
- booster for woocommerce, pluggabl booster for woocommerce – pdf invoices, abandoned cart, variation swatches & 100+ tools +1 moreBooster for WooCommerce <= 7.1.0 - Authenticated (Subscriber+) Information Disclosure via Shortcode4.3 Medium
- gvectors wpdiscuz, advancedcoding comments – wpdiscuz +1 morewpDiscuz <= 7.6.3 - Insecure Direct Object Reference to Post Rating Increase/Decrease5.3 Medium
- automattic jetpack crm, jetpack crm – clients, leads, invoices, billing, email marketing, & automation +1 moreJetpack CRM <= 5.3.1 - Cross-Site Request Forgery and PHAR Deserialization7.5 High
- ravanh skype legacy buttonsSkype Legacy Buttons <= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- brizy, themefusecom brizy – page builder +1 moreBrizy < 1.0.126 - Authorization Bypass to Settings Updates7.4 High
- quantumcloud wpbot, wpbot – ai chatbot for live support, lead generation, ai services +1 moreAI ChatBot <= 4.8.9 and 4.9.2 - Cross-Site Request Forgery on AJAX actions4.3 Medium
- pluginus bear - woocommerce bulk editor and products manager professional, realmag777 bear – bulk editor and products manager professional for woocommerce by pluginus.net +1 moreBEAR <= 1.1.3.3 - Missing Authorization to Product Deletion5.4 Medium
- pluginus bear - woocommerce bulk editor and products manager professional, realmag777 bear – bulk editor and products manager professional for woocommerce by pluginus.net +1 moreBEAR <= 1.1.3.3 - Cross-Site Request Forgery to Product Deletion5.4 Medium
- poptin – exit pop ups & email popups, popups +1 morePoptin <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- miniorange google authenticator, cyberlord92 miniorange 2fa – two-factor authentication for wordpress (sms, email & google authenticator) +1 moreminiOrange's Google Authenticator <= 5.6.5 - Missing Authorization to Plugin Settings Change7.5 High
- lavasoft web companionM-Files Web Companion allows Remote Code Execution for some filetypes8.2 High
- lavasoft web companionM-Files Web Companion allows Remote Code Execution8.6 High
- m-files classic web, web +1 moreStored XSS Vulnerability in M-Files Classic Web7.3 High
- cerber wp cerber security\, anti-spam \& malware scan, gioni wp cerber security, anti-spam & malware scan +1 moreWP Cerber Security <= 9.1 - Unauthenticated Stored Cross-Site Scripting7.2 High
- wpeka wplegalpages, wplegalpages privacy policy generator – wplp legal pages +1 moreWPLegalPages <= 2.9.2 - Authenticated (Author+) Stored Cross-Site Scripting via Shortcode5.5 Medium
- hyno dropbox folder shareDropbox Folder Share <= 1.9.7 - Unauthenticated Local File Inclusion9.8 Critical
- pluginus bear - woocommerce bulk editor and products manager professional, realmag777 bear – bulk editor and products manager professional for woocommerce by pluginus.net +1 moreBEAR <= 1.1.3.3 - Cross-Site Request Forgery to Profile Creation4.3 Medium
- radykal fancy product designerFancy Product Designer <= 4.6.9 - Insufficient Authorization on Mulitple AJAX Actions6.3 Medium
- wpvividplugins migration, backup, staging – wpvivid, wpvivid migration\, backup\, staging +1 moreThe Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to Directory...8.7 High
- rightpress woocommerce dynamic pricing and discounts, woocommerce dynamic pricing \& discounts +1 moreWooCommerce Dynamic Pricing and Discounts <= 2.4.1 - Unauthenticated Settings Import/Export5.3 Medium
- pluginus bear - woocommerce bulk editor and products manager professional, realmag777 bear – bulk editor and products manager professional for woocommerce by pluginus.net +1 moreBEAR <= 1.1.3.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting4.3 Medium
- simple-press simple\, simplepress simple:press forum, thesimplepressforumteam simple\:press forum +2 moreSimple:Press – WordPress Forum Plugin <= 6.6.0 - Arbitrary File Upload9.8 Critical
- wpvivid migration\, backup\, staging, wpvividplugins wpvivid — backup, migration & staging +1 moreMigration, Backup, Staging – WPvivid <= 0.9.91 - Google Drive Client Secret Exposure8.0 High
- icegram express, email subscribers & newsletters – email marketing, post notifications & newsletter plugin for wordpress +1 moreIcegram Express <= 5.6.23 - Authenticated (Administrator+) Directory Traversal to Arbitrary File Read9.1 Critical
- pluginus bear - woocommerce bulk editor and products manager professional, realmag777 bear – bulk editor and products manager professional for woocommerce by pluginus.net +1 moreBEAR <= 1.1.3.3 - Cross-Site Request Forgery to Product Manipulation4.3 Medium
- deanoakley photospace responsive galleryPhotospace Responsive <= 2.1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting4.4 Medium
- iframe project iframeiframe <= 4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'iframe' Shortcode6.4 Medium
- flowpaperflowpaper <= 2.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- wpvivid migration\, backup\, staging, wpvividplugins wpvivid — backup, migration & staging +1 moreMigration, Backup, Staging – WPvivid <= 0.9.89 - Authenticated Stored Cross-Site Scripting4.4 Medium
- bozdoz leaflet mapLeaflet Map <= 3.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- pluginus bear - woocommerce bulk editor and products manager professional, realmag777 bear – bulk editor and products manager professional for woocommerce by pluginus.net +1 moreBEAR <= 1.1.3.3 - Cross-Site Request Forgery to Product Manipulation4.3 Medium
- plugin waiting, pluginbuilders waiting: one-click countdowns +1 moreWaiting: One-click countdowns <= 0.6.2 - Authenticated (Administrator+) Cross-Site Scripting5.5 Medium
- Show moreLoading…