CVEs published in December 2023
2,760 vulnerabilities, 382 critical, 9 exploited.
- boiteasite rencontre, jacques malgrange rencontre – dating site +1 moreWordPress Rencontre – Dating Site Plugin <= 3.11.1 is vulnerable to PHP Object Injection9.9 Critical
- realmag777 active products tables for woocommerce. professional products tables for woocommerce store, pluginus woot +1 moreWordPress Active Products Tables for WooCommerce Plugin <= 1.0.6 is vulnerable to PHP Object Injection10.0 Critical
- themehigh job manager & career – manage job board listings, and recruitments, job manager \& career +1 moreWordPress Job Manager & Career Plugin <= 1.4.4 is vulnerable to Cross Site Request Forgery (CSRF) leading to PHP Object Injection9.6 Critical
- mattermostMattermost version 2.10.0 and earlier fails to sanitize deeplink paths, which allows an attacker...7.1 High
- mattermost, mattermost server +1 moreMattermost Cross-site Scripting vulnerability3.7 Low
- leevio happy addons for elementorWordPress Happy Addons for Elementor Plugin <= 3.9.1.1 is vulnerable to Server Side Request Forgery (SSRF)4.9 Medium
- inspireui mstore api, mstore api +1 moreWordPress MStore API Plugin <= 4.10.1 is vulnerable to Cross Site Request Forgery (CSRF)5.4 Medium
- saad iqbal new user approveWordPress New User Approve Plugin <= 2.5.1 is vulnerable to Cross Site Request Forgery (CSRF)4.3 Medium
- webba-agency appointment & event booking calendar plugin – webba booking, webba-booking webba booking +1 moreWordPress Webba Booking Plugin <= 4.5.33 is vulnerable to Cross Site Request Forgery (CSRF)4.3 Medium
- bright plugins block ips for gravity formsWordPress Block IPs for Gravity Forms Plugin <= 1.0.1 is vulnerable to Cross Site Request Forgery (CSRF)5.4 Medium
- eaglethemes rise blocks – a complete gutenberg page builder, eaglevisionit rise blocks, rise themes blocks – a complete gutenberg page builder +2 moreWordPress Rise Blocks Plugin <= 3.1 is vulnerable to Cross Site Request Forgery (CSRF)5.4 Medium
- brain storm force ultimate addons for wpbakery page builderWordPress Ultimate Addons for WPBakery Page Builder Plugin <= 3.19.17 is vulnerable to Cross Site Request Forgery (CSRF)4.3 Medium
- cloudflare wranglerArbitrary remote code execution within wrangler dev Workers sandbox8.5 High
- cloudflare wranglerArbitrary remote file read in Wrangler dev server6.4 Medium
- cloudflare miniflareServer-Side Request Forgery (SSRF) in Miniflare7.5 High
- pandora fms fms, pandorafms pandora fms +1 moreXSS in Visual Console6.1 Medium
- pandora fms fms, pandorafms pandora fms +1 moreSQL Injection in Visual Console5.9 Medium
- pandora fms fms, pandorafms pandora fms +1 moreXSS in File manager7.5 High
- pandora fms fms, pandorafms pandora fms +1 moreXSS Vulnerability Messages3.7 Low
- webfactory login lockdown – protect login form, webfactoryltd wp login lockdown +1 moreWordPress Login Lockdown Plugin <= 2.06 is vulnerable to SQL Injection7.6 High
- pandora fms fms, pandorafms pandora fms +1 moreUser notification settings edition3.0 Low
- automattic wordpress.com editing toolkitWordPress WordPress.com Editing Toolkit Plugin <= 3.78784 is vulnerable to Cross Site Scripting (XSS)6.5 Medium
- buddypressWordPress BuddyPress Plugin <= 11.3.1 is vulnerable to Cross Site Scripting (XSS)6.5 Medium
- aam advanced access manager – restricted content, users & roles, enhanced security and more, vasyltech advanced access manager +1 moreWordPress Advanced Access Manager Plugin <= 6.9.15 is vulnerable to Cross Site Scripting (XSS)6.5 Medium
- fastlinemedia beaver builder, justinbusa beaver builder – wordpress page builder +1 moreWordPress Beaver Builder Plugin <= 2.7.2 is vulnerable to Cross Site Scripting (XSS)6.5 Medium
- zoho forms form plugin for wordpress – zoho forms, zohocorp zoho forms +1 moreWordPress Zoho Forms Plugin <= 3.0.1 is vulnerable to Cross Site Scripting (XSS)6.5 Medium
- codex-themes thegem, codexthemes thegem - creative multi-purpose & woocommerce wordpress theme +1 moreWordPress TheGem Theme <= 5.9.1 is vulnerable to Cross Site Scripting (XSS)7.1 High
- upsolution impreza, impreza – wordpress website and woocommerce builder +1 moreWordPress UpSolution Core Plugin <= 8.17.4 is vulnerable to Cross Site Scripting (XSS)7.1 High
- boldgrid weforms – easy drag & drop contact form builder for wordpress, weforms – easy drag & drop contact form builder for wordpress, weformspro weforms +2 moreWordPress weForms Plugin <= 1.6.17 is vulnerable to Cross Site Scripting (XSS)5.9 Medium
- devitemsllc ht mega – absolute addons for elementor, hasthemes ht mega +1 moreWordPress HT Mega Plugin <= 2.3.8 is vulnerable to Cross Site Scripting (XSS)7.1 High
- ginger plugins sticky chat widget: click to chat, sms, email, messages, call button, live chat and live support button, gingerplugins sticky chat widget +1 moreWordPress Sticky Chat Widget Plugin <= 1.1.8 is vulnerable to Cross Site Scripting (XSS)5.9 Medium
- bit assist chat widget: whatsapp chat, facebook messenger chat, telegram chat bubble, line messenger, live chat support chat button, wechat, sms, call button, customer support button with floating chat widget, bitapps bit assist +1 moreWordPress Bit Assist Plugin <= 1.1.9 is vulnerable to Cross Site Scripting (XSS)5.9 Medium
- ian kennerley google photos gallery with shortcodesWordPress Google Photos Gallery with Shortcodes Plugin <= 4.0.2 is vulnerable to Cross Site Scripting (XSS)7.1 High
- hasthemes hashbar, hashbar – wordpress notification bar +1 moreWordPress HashBar – WordPress Notification Bar Plugin <= 1.4.1 is vulnerable to Cross Site Scripting (XSS)5.9 Medium
- zerobounce email verification & validation, email verification \& validation +1 moreWordPress ZeroBounce Email Verification & Validation Plugin <= 1.0.11 is vulnerable to Cross Site Scripting (XSS)5.9 Medium
- brizy, brizy.io brizy – page builder +1 moreWordPress Brizy – Page Builder Plugin <= 2.4.29 is vulnerable to Cross Site Scripting (XSS)6.5 Medium
- brainstorm force wp remote site searchWordPress WP Remote Site Search Plugin <= 1.0.4 is vulnerable to Cross Site Scripting (XSS)6.5 Medium
- wpfactory back button widgetWordPress Back Button Widget Plugin <= 1.6.3 is vulnerable to Cross Site Scripting (XSS)6.5 Medium
- aleksandar urošević stock tickerWordPress Stock Ticker Plugin <= 3.23.4 is vulnerable to Cross Site Scripting (XSS)6.5 Medium
- westguard ws form lite – drag & drop contact form builder for wordpress, westguardsolutions ws form, ws form lite – drag & drop contact form builder for wordpress +2 moreWordPress WS Form LITE Plugin <= 1.9.170 is vulnerable to SQL Injection7.6 High
- ibericode mailchimp, pluginops mailchimp subscribe form, optin builder, popup builder, form builder +1 moreWordPress MailChimp Subscribe Forms Plugin <= 4.0.9.3 is vulnerable to Open Redirection4.7 Medium
- pexle chris library viewerWordPress Library Viewer Plugin <= 2.0.6 is vulnerable to Open Redirection4.7 Medium
- dylan james zephyr project manager, zephyr project manager project project manager +1 moreWordPress Zephyr Project Manager Plugin <= 3.3.9 is vulnerable to Open Redirection4.7 Medium
- wp directory kit directory kit, wpdirectorykit wp directory kit +1 moreWordPress WP Directory Kit Plugin <= 1.1.9 is vulnerable to Open Redirection4.7 Medium
- crm perks integration for hubspot and contact form 7, wpforms, elementor, ninja forms, crmperks database for contact form 7\, wpforms\, elementor forms +1 moreWordPress Integration for Contact Form 7 HubSpot Plugin <= 1.2.8 is vulnerable to Open Redirection4.7 Medium
- solidwp solid security – password, two factor authentication, and brute force protection, solid security +1 moreWordPress Solid Security Plugin <= 8.1.4 is vulnerable to Open Redirection3.7 Low
- miniorange google authenticator, miniorange's google authenticator – wordpress two factor authentication – 2fa , two factor, otp sms and email | passwordless login +1 moreWordPress miniOrange's Google Authenticator Plugin <= 5.6.1 is vulnerable to Sensitive Data Exposure8.1 High
- poly lens, trio 8500, trio 8800 +2 more +4 morePoly Trio 8500/Trio 8800/Trio C60 Poly Lens Management Cloud Registration authorization4.3 Medium
- poly trio 8800, trio 8800 firmware +1 morePoly Trio 8800 Test Automation Mode backdoor6.2 Medium
- poly ccx 400, ccx 600, trio 8800 +5 more +7 morePoly CCX 400/CCX 600/Trio 8800/Trio C60 Web Interface protection mechanism2.7 Low
- Show moreLoading…