CVEs published in December 2023
2,760 vulnerabilities, 382 critical, 9 exploited.
- getsocial, s.a. social share buttons & analytics plugin – getsocial.io, getsocial social share buttons \& analytics +1 moreWordPress Social Share Buttons & Analytics Plugin – GetSocial.io Plugin <= 4.3.12 is vulnerable to Cross Site Scripting (XSS)5.9 Medium
- zealousweb track geolocation of users using contact form 7WordPress Track Geolocation Of Users Using Contact Form 7 Plugin <= 2.0 is vulnerable to Cross Site Scripting (XSS)5.9 Medium
- spoon themes adifier - classified ads wordpress theme, spoonthemes adifier +1 moreWordPress Adifier System Plugin < 3.1.4 is vulnerable to Cross Site Scripting (XSS)7.1 High
- doofinder, doofinder wp & woocommerce search +1 moreWordPress Doofinder for WooCommerce Plugin <= 2.1.7 is vulnerable to Cross Site Scripting (XSS)7.1 High
- wpdeveloper parallax slider blockWordPress Parallax Slider Block Plugin <= 1.2.4 is vulnerable to Cross Site Scripting (XSS)5.9 Medium
- nextscripts nextscripts: social networks auto-poster, social networks auto poster +1 moreWordPress NextScripts Plugin <= 4.4.2 is vulnerable to Cross Site Scripting (XSS)7.1 High
- fabio marzocca list all posts by authors, nested categories and titles, marzocca list all posts by authors nested categories and titles +1 moreImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting')...7.1 High
- wp event manager – events calendar, registrations, sell tickets with woocommerce, wp-eventmanager wp event manager, wpeventmanager wp event manager – events calendar, registrations, sell tickets with woocommerce +2 moreWordPress WP Event Manager Plugin <= 3.1.40 is vulnerable to Cross Site Scripting (XSS)5.9 Medium
- ternstyle automatic youtube video posts, ternstyle llc automatic youtube video posts plugin +1 moreWordPress Automatic Youtube Video Posts Plugin Plugin <= 5.2.2 is vulnerable to Cross Site Scripting (XSS)5.9 Medium
- avecnous event postWordPress Event post Plugin <= 5.8.6 is vulnerable to Cross Site Scripting (XSS)6.5 Medium
- hdwplayer hdw player, mr. hdwplayer hdw player plugin (video player & video gallery) +1 moreWordPress HDW Player Plugin (Video Player & Video Gallery) Plugin <= 5.0 is vulnerable to Cross Site Scripting (XSS)7.1 High
- gilles dumas which template fileWordPress which template file Plugin <= 4.9.0 is vulnerable to Cross Site Scripting (XSS)7.1 High
- coderevolution wp pocket urlsWordPress WP Pocket URLs Plugin <= 1.0.2 is vulnerable to Cross Site Scripting (XSS)7.1 High
- kreativo pro kp fastest tawk.to chatWordPress KP Fastest Tawk.to Chat Plugin <= 1.1.1 is vulnerable to Cross Site Scripting (XSS)5.9 Medium
- dfactory responsive lightbox & gallery, responsive lightbox +1 moreWordPress Responsive Lightbox Plugin <= 2.4.5 is vulnerable to Cross Site Scripting (XSS)5.9 Medium
- captainform, captainform forms by captainform – form builder for wordpress +1 moreWordPress Forms by CaptainForm Plugin <= 2.5.3 is vulnerable to Cross Site Scripting (XSS)7.1 High
- datafeedr ads by datafeedr.comWordPress Ads by datafeedr.com Plugin <= 1.2.0 is vulnerable to Cross Site Scripting (XSS)6.5 Medium
- real big plugins client dashWordPress Client Dash Plugin <= 2.2.1 is vulnerable to Cross Site Scripting (XSS)5.9 Medium
- till krüss email address encoderWordPress Email Address Encoder Plugin <= 1.0.22 is vulnerable to Cross Site Scripting (XSS)6.5 Medium
- formzu wpWordPress Formzu WP Plugin <= 1.6.6 is vulnerable to Cross Site Scripting (XSS)6.5 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2023.3.22268 authorization check for inline comments inside thread...4.3 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2023.11.1 a CSRF on login was possible4.3 Medium
- tuta tutanotaRemote Code Execution via insufficiently sanitized call to shell.openExternal9.3 Critical
- apache streampark, apache software foundation streampark (incubating) +1 moreApache StreamPark (incubating): Authenticated system users could trigger SQL injection vulnerability4.9 Medium
- apache streampark, apache software foundation streampark (incubating) +1 moreApache StreamPark (incubating): Authenticated system users could trigger remote command execution7.2 High
- idemia morphowave compact/xp, morphowave sp, morphowave compact firmware +11 more +13 moreStack buffer overflow when reading DESFire card6.8 Medium
- idemia morphowave compact/xp, morphowave sp, morphowave compact firmware +11 more +13 moreHeap Buffer Overflow when reading DESFire card6.8 Medium
- idemia morphowave compact/xp, morphowave sp, morphowave compact firmware +11 more +13 moreStack Buffer Overflow when checking some attributes during retrofit9.1 Critical
- idemia morphowave compact/xp, morphowave sp, morphowave compact firmware +11 more +13 moreStack Buffer Overflow when checking retrofit package9.1 Critical
- idemia morphowave compact/xp, morphowave sp, morphowave compact firmware +11 more +13 moreStack Buffer Overflow in a binary run at upgrade startup9.1 Critical
- backupbliss backup migration, inisev backupbliss – backup & migration with free cloud storage +1 moreBackup Migration <= 1.3.7 - Unauthenticated Remote Code Execution9.8 Critical
- idemia morphowave compact/xp, morphowave sp, morphowave compact firmware +11 more +13 moreMissing integrity check on upgrade package7.5 High
- adobe experience manager, experience manager cloud service +1 moreAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)5.4 Medium
- adobe experience managerAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)5.4 Medium
- adobe experience manager, experience manager cloud service +1 moreAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)5.4 Medium
- adobe experience manager, experience manager cloud service +1 moreAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)5.4 Medium
- adobe experience manager, experience manager cloud service +1 moreAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)5.4 Medium
- adobe experience managerAdobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79)5.4 Medium
- adobe experience managerAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)5.4 Medium
- adobe experience manager, experience manager cloud service +1 moreAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)5.4 Medium
- adobe experience manager, experience manager cloud service +1 moreAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)5.4 Medium
- adobe experience managerAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)5.4 Medium
- adobe experience manager, experience manager cloud service +1 moreAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)5.4 Medium
- adobe experience manager, experience manager cloud service +1 moreAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)5.4 Medium
- adobe experience manager, experience manager cloud service +1 moreAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)5.4 Medium
- adobe experience managerAdobe Experience Manager | Improper Access Control (CWE-284)5.3 Medium
- adobe experience managerAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)5.4 Medium
- adobe experience manager, experience manager cloud service +1 moreAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)5.4 Medium
- adobe experience managerAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)5.4 Medium
- adobe experience manager, experience manager cloud service +1 moreAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)5.4 Medium
- Show moreLoading…