CVEs published in November 2023
2,587 vulnerabilities, 293 critical, 11 exploited.
- weather atlas widget, weather-atlas weather atlas, weatheratlas weather atlas widget +2 moreWeather Atlas Widget <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- stevehenty drop shadow boxesDrop Shadow Boxes <= 1.7.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- userproplugin userproUserPro <= 5.1.1 - Authentication Bypass to Administrator9.8 Critical
- funnelforms, funnelforms interactive contact form and multi step form builder with drag & drop editor – funnelforms free +1 moreFunnelforms Free <= 3.4 - Missing Authorization to Category Deletion4.3 Medium
- peachpay related products for woocommerceRelated Products for WooCommerce <= 3.3.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- chief gnome garden gnome packageGarden Gnome Package <= 2.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- wpvnteam wp extra, wpvncom wp extra – one click optimize +1 moreWP EXtra <= 6.2 - Missing Authorization to Arbitrary Email Sending4.3 Medium
- funnelforms, funnelforms interactive contact form and multi step form builder with drag & drop editor – funnelforms free +1 moreFunnelforms Free <= 3.4 - Missing Authorization to Post Modification4.3 Medium
- themeblvd theme blvd shortcodesTheme Blvd Shortcodes <= 1.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- userproplugin userproUserPro <= 5.1.4 - Missing Authorization to Arbitrary Shortcode Execution via userpro_shortcode_template6.5 Medium
- userproplugin userproUserPro <= 5.1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting via userpro_save_userdata6.1 Medium
- mainwp, mainwp dashboard: self-hosted wordpress management for agencies +1 moreMainWP Dashboard <= 4.5.1.2 - Authenticated(Administrator+) CSS Injection2.2 Low
- davidvongries ultimate dashboard, ultimate dashboard – custom wordpress dashboard +1 moreUltimate Dashboard <= 3.7.7 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings4.4 Medium
- funnelforms, funnelforms interactive contact form and multi step form builder with drag & drop editor – funnelforms free +1 moreFunnelforms Free <= 3.4 - Cross-Site Request Forgery to Arbitrary Post Deletion6.5 Medium
- 10web wdcontactformbuilder, web-dorado wp form builder +1 moreWDContactFormBuilder <= 1.0.72 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- userproplugin userproUserPro <= 5.1.1 - Cross-Site Request Forgery to Privilege Escalation8.8 High
- lifterlms, chrisbadgett lifterlms – wp lms for elearning, online courses, & quizzes +1 moreLifterLMS <= 7.4.2 - Authenticated(Administrator+) Directory Traversal to Arbitrary CSV File Deletion3.3 Low
- funnelforms, funnelforms interactive contact form and multi step form builder with drag & drop editor – funnelforms free +1 moreFunnelforms Free <= 3.4 - Missing Authorization to New Category Creation4.3 Medium
- userproplugin userproUserPro <= 5.1.1 - Missing Authorization via multiple functions7.3 High
- funnelforms, funnelforms interactive contact form and multi step form builder with drag & drop editor – funnelforms free +1 moreFunnelforms Free <= 3.4 - Missing Authorization to Test Email Sending4.3 Medium
- gopi plus wp anything sliderWp anything slider <= 9.1 - Authenticated (Subscriber+) SQL Injection via Shortcode8.8 High
- designplus tcd google mapsTCD Google Maps <= 1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- ibenic sponsorsSponsors <= 3.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- funnelforms, funnelforms interactive contact form and multi step form builder with drag & drop editor – funnelforms free +1 moreFunnelforms Free <= 3.4 - Missing Authorization to Arbitrary Post Deletion6.5 Medium
- infornweb blog designer pack – blog, post grid, post slider, post carousel, category post, news, news \& blog designer pack, news \& blog designer pack wordpress blog plugin +2 moreNews & Blog Designer Pack – WordPress Blog Plugin <= 3.4.1 - Unauthenticated Remote Code Execution via Local File Inclusion8.1 High
- dwuser easyrotator for wordpress, dwusercom easyrotator for wordpress – slider plugin +1 moreEasyRotator for WordPress <= 1.0.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- bompus wp customer reviewsWP Customer Reviews <= 3.6.6 - Authenticated (Subscriber+) Sensitive Information Exposure4.3 Medium
- codedropz drag and drop multiple file upload - contact form 7, glenwpcoder drag and drop multiple file upload for contact form 7 +1 moreDrag and Drop Multiple File Upload - Contact Form 7 <= 1.3.7.3 - Unauthenticated Arbitrary File Upload8.1 High
- jose-lazo delete usermetas, joselazo delete usermeta +1 moreDelete Usermetas <= 1.1.2 - Cross-Site Request Forgery4.3 Medium
- funnelforms, funnelforms interactive contact form and multi step form builder with drag & drop editor – funnelforms free +1 moreFunnelforms Free <= 3.4 - Missing Authorization to Category Update4.3 Medium
- jonashjalmarsson html filter and csv-file searchHTML filter and csv-file search <= 2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- themepoints tab ultimateTab Ultimate <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- zorem advanced local pickup for woocommerce, local pickup +1 moreAdvanced Local Pickup for WooCommerce <= 1.5.5 - Authenticated (Administrator+) SQL Injection7.2 High
- vektor-inc vk blocksVK Blocks <= 1.63.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block6.4 Medium
- nautobotnautobot has XSS potential in custom links, job buttons, and computed fields7.1 High
- exeebit phpinfo() wp, phpinfo-wp +1 moreWordPress phpinfo() WP Plugin <= 4.0 is vulnerable to Cross Site Request Forgery (CSRF)5.4 Medium
- wppool sheets to wp table live syncWordPress Sheets To WP Table Live Sync Plugin <= 2.12.15 is vulnerable to Cross Site Request Forgery (CSRF)5.4 Medium
- accesspress themes social auto posterWordPress Social Auto Poster Plugin <= 2.1.4 is vulnerable to Cross Site Request Forgery (CSRF)5.4 Medium
- passionate brains add expires headers & optimized minify, passionatebrains add expires headers \& optimized minify +1 moreWordPress Add Expires Headers & Optimized Minify Plugin <= 2.7 is vulnerable to Cross Site Request Forgery (CSRF)4.3 Medium
- wpstreamWordPress WpStream – Live Streaming, Video on Demand, Pay Per View Plugin <= 4.4.10 is vulnerable to Cross Site Request Forgery (CSRF)4.3 Medium
- yoohoo plugins when last loginWordPress When Last Login Plugin <= 1.2.1 is vulnerable to Cross Site Request Forgery (CSRF)4.3 Medium
- lws toolsWordPress LWS Tools Plugin <= 2.3.1 is vulnerable to Cross Site Request Forgery (CSRF)5.4 Medium
- connekthq instant imagesWordPress Instant Images Plugin <= 5.1.0.2 is vulnerable to Server Side Request Forgery (SSRF)7.2 High
- chameleon power power, hyphensolutions chameleon power +1 morePath traversal vulnerability in Chameleon Power products7.5 High
- veom service tracking, veon computer service tracking software +1 moreSQLi in Veon Computer's Service Tracking Software9.8 Critical
- techsoupeurope leykaWordPress Leyka Plugin <= 3.29.2 is vulnerable to Cross Site Request Forgery (CSRF)5.4 Medium
- decalogWordPress DecaLog Plugin <= 3.7.0 is vulnerable to Cross Site Request Forgery (CSRF)4.3 Medium
- fluenx deepl api translation plugin, deepl pro api translation +1 moreWordPress DeepL Pro API translation Plugin <= 2.1.4 is vulnerable to Cross Site Request Forgery (CSRF)4.3 Medium
- pixelgrade customify, customify – intuitive website styling +1 moreWordPress Customify Plugin <= 2.10.4 is vulnerable to Cross Site Request Forgery (CSRF)4.3 Medium
- codeboxr cbx currency converterWordPress CBX Currency Converter Plugin <= 3.0.3 is vulnerable to Cross Site Request Forgery (CSRF)5.4 Medium
- Show moreLoading…