CVEs published in December 2023
2,760 vulnerabilities, 382 critical, 9 exploited.
- e2pdf, e2pdf.com e2pdf – export to pdf tool for wordpress +1 moreWordPress e2pdf Plugin <= 1.20.18 is vulnerable to PHP Object Injection6.6 Medium
- clever plugins delete duplicate postsWordPress Delete Duplicate Posts Plugin <= 4.8.9 is vulnerable to Broken Access Control4.3 Medium
- roland barker, xnau webdesign participants databaseWordPress Participants Database Plugin <= 2.5.5 is vulnerable to Broken Access Control4.3 Medium
- gordon böhme, antonio leutsch structured content (json-ld) #wpsc, wpsc-plugin structured content +1 moreWordPress Structured Content Plugin <= 1.5.3 is vulnerable to PHP Object Injection7.5 High
- quicoto thumbs ratingWordPress Thumbs Rating Plugin <= 5.0.0 is vulnerable to Race Condition5.3 Medium
- libssh, fedoraproject fedora, red hat enterprise linux 6 +4 more +6 moreLibssh: missing checks for return values for digests3.7 Low
- typelevel grackleGrackle has StackOverflowError in GraphQL query processing7.5 High
- averta master slider pro, master slider pro, masterslider master slider +2 moreWordPress Master Slider Pro Plugin <= 3.6.5 is vulnerable to SQL Injection7.6 High
- redhat keycloak, red hat build of keycloak 22, build of keycloak 22.0.8 +7 more +9 moreKeycloak: open redirect via "form_post.jwt" jarm response mode4.6 Medium
- wpvibes redirect 404 error page to homepage or custom page with logsWordPress Redirect 404 Error Page to Homepage or Custom Page with Logs Plugin <= 1.8.7 is vulnerable to SQL Injection7.6 High
- mahlamusa who hit the page – hit counter, lindeni who hit the page - hit counter +1 moreWordPress Who Hit The Page – Hit Counter Plugin <= 1.4.14.3 is vulnerable to SQL Injection7.6 High
- woo product vendorsWordPress WooCommerce Product Vendors Plugin <= 2.1.76 is vulnerable to SQL Injection8.5 High
- alex raven wp report postWordPress WP Report Post Plugin <= 2.1.2 is vulnerable to SQL Injection7.6 High
- livechat, livechat – wp live chat plugin for wordpress +1 moreWordPress LiveChat Plugin <= 4.5.15 is vulnerable to Cross Site Request Forgery (CSRF)5.4 Medium
- creatomatic cspriteWordPress CSprite Plugin <= 1.1 is vulnerable to Cross Site Request Forgery (CSRF)4.3 Medium
- gravity master product enquiry for woocommerceWordPress Product Enquiry for WooCommerce Plugin <= 3.0 is vulnerable to Cross Site Request Forgery (CSRF)5.4 Medium
- giannopoulos kostas wpsoononlinepageWordPress WPsoonOnlinePage Plugin <= 1.9 is vulnerable to Cross Site Request Forgery (CSRF)5.4 Medium
- gvectors team woodiscuz – woocommerce comments, gvectors woodiscuz - woocommerce comments +1 moreWordPress WooDiscuz – WooCommerce Comments Plugin <= 2.3.0 is vulnerable to Cross Site Request Forgery (CSRF)5.4 Medium
- michael winkler teachpressWordPress teachPress Plugin <= 9.0.5 is vulnerable to Cross Site Request Forgery (CSRF)5.4 Medium
- wow-company button generator – easily button builder, button generator +1 moreWordPress Button Generator – easily Button Builder Plugin <= 2.3.8 is vulnerable to Cross Site Request Forgery (CSRF)4.3 Medium
- saiful islam add to cart text changer and customize button, add custom icon, codeastrology add to cart text changer and customize button\, add custom icon +1 moreWordPress Add to Cart Text Changer and Customize Button, Add Custom Icon Plugin <= 2.0 is vulnerable to Cross Site Request Forgery (CSRF)4.3 Medium
- affiliatebooster affiliate booster, kulwant nagi affiliate booster – pros & cons, notice, and cta blocks for affiliates +1 moreWordPress Affiliate Booster – Pros & Cons, Notice, and CTA Blocks for Affiliates Plugin <= 3.0.5 is vulnerable to Cross Site Request Forgery (CSRF)5.4 Medium
- marketing rapel mkrapel regiones y ciudades de chile para wcWordPress MkRapel Regiones y Ciudades de Chile para WC Plugin <= 4.3.0 is vulnerable to Cross Site Request Forgery (CSRF)4.3 Medium
- villatheme product size chart for woocommerceWordPress Product Size Chart For WooCommerce Plugin <= 1.1.5 is vulnerable to Cross Site Request Forgery (CSRF)5.4 Medium
- wp doctor woocommerce login redirectWordPress WooCommerce Login Redirect Plugin <= 2.2.4 is vulnerable to Cross Site Request Forgery (CSRF)5.4 Medium
- gallagher command centre diagnostics service, command centre +1 moreA reliance on untrusted inputs in a security decision could be exploited by a privileged user to...5.5 Medium
- gallagher controller 6000, controller 6000 firmware +1 moreSensitive information uncleared after debug/power state transition in the Controller 6000 could...2.4 Low
- gallagher controller 6000, controller 6000 firmware +1 moreA format string issue in the Controller 6000's optional diagnostic web interface can be used...7.5 High
- gallagher command centre, command centre server +1 moreAn observable response discrepancy in the Gallagher Command Centre RESTAPI allows an...4.3 Medium
- gallagher command centre server, command centre +1 moreIncorrect behavior order in the Command Centre Server could allow privileged users to gain...4.3 Medium
- gallagher command centreClient-Side enforcement of Server-Side security for the Command Centre server could be bypassed...5.4 Medium
- arul prasad j prevent landscape rotationWordPress Prevent Landscape Rotation Plugin <= 2.0 is vulnerable to Cross Site Request Forgery (CSRF)5.4 Medium
- gallagher command centre, controller 6000/ controller 7000, controller 6000 firmware +2 moreImproper input validation of a large HTTP request in the Controller 6000 and Controller 7000...3.1 Low
- blue coral chat bubble – floating chat with contact chat icons, messages, telegram, email, sms, call me back, bluecoral chat bubble +1 moreWordPress Chat Bubble Plugin <= 2.3 is vulnerable to Cross Site Request Forgery (CSRF)4.3 Medium
- gallagher controller 7000, controller 7000 firmware +1 moreIncorrect selection of fuse values in the Controller 7000 platform allows an attacker to bypass...6.8 Medium
- codeastrology quantity plus minus button for woocommerce, codeastrology team quantity plus minus button for woocommerce by codeastrology +1 moreWordPress Quantity Plus Minus Button for WooCommerce by CodeAstrology Plugin <= 1.1.9 is vulnerable to Cross Site Request Forgery (CSRF)4.3 Medium
- ibm cloud pak for business automationIBM Cloud Pak for Business Automation information disclosure4.9 Medium
- soflyy wp all export, unknown export any wordpress data to xml/csv, wp all export pro +1 more +3 moreWP All Export (Free < 1.4.1, Pro < 1.8.6) - Remote Code Execution via CSRF8.8 High
- soflyy wp all export, unknown export any wordpress data to xml/csv, wp all export pro +1 more +3 moreWP All Export (Free < 1.4.0, Pro < 1.8.6) - Admin+ RCE7.2 High
- wpmudev smartcrawl, unknown smartcrawl wordpress seo checker, seo analyzer, seo optimizer +1 moreSmartCrawl WordPress SEO checker < 3.8.3 - Unauthenticated Password Protected Post Disclosure7.5 High
- unknown slider, wpfrank slider factory pro +1 moreSlider - Ultimate Responsive Image Slider < 3.5.12 - Subscriber+ Arbitrary Post Access6.5 Medium
- gpriday siteorigin widgets bundle, siteorigin widgets bundle +1 moreso-widgets-bundle < 1.51.0 - Admin+ Local File Inclusion7.2 High
- swteplugins swift performance, unknown swift performance lite +1 moreSwift Performance Lite <= 2.3.6.14 - Unauthenticated Configuration Export4.3 Medium
- multivendorx product catalog mode for woocommerceProduct Catalog Enquiry for WooCommerce < 5.0.3 - Unauthenticated Stored XSS via Arbitrary Setting Update6.1 Medium
- unknown vrm 360 3d model viewer, maurice vrm360 +1 moreVrm 360 3D Model Viewer <= 1.2.1 - Contributor+ Arbitrary File Upload Leading to RCE8.8 High
- soflyy wp all export, unknown export any wordpress data to xml/csv, wp all export pro +1 more +3 moreWP All Export (Free < 1.4.1, Pro < 1.8.6) - Author+ PHAR Deserialization via CSRF8.8 High
- quttera web malware scanner, unknown quttera web malware scanner +1 moreQuttera Web Malware Scanner < 3.4.2.1 - Directory Listing to Sensitive Data Exposure5.3 Medium
- thememylogin 2fa, unknown tml-2fa +1 moreTheme My Login 2FA < 1.2 - Lack of Rate Limiting9.8 Critical
- codesmade autocomplete location field contact form 7, unknown autocomplete location field contact form 7 pro +1 moreAutocomplete Location field Contact Form 7 < 3.0 - Admin+ Store Cross-Site Scripting4.8 Medium
- quttera web malware scanner, unknown quttera web malware scanner +1 moreQuttera Web Malware Scanner < 3.4.2.1 - Admin+ Path Traversal7.2 High
- Show moreLoading…