Export limit exceeded: 414360 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (414360 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2023-5133 | 1 Solwininfotech | 1 User Activity Log | 2025-04-23 | 7.5 High |
| This user-activity-log-pro WordPress plugin before 2.3.4 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate its value. This may be used to hide the source of malicious traffic. | ||||
| CVE-2023-5089 | 1 Wpmudev | 1 Defender Security | 2025-04-23 | 5.3 Medium |
| The Defender Security WordPress plugin before 4.1.0 does not prevent redirects to the login page via the auth_redirect WordPress function, allowing an unauthenticated visitor to access the login page, even when the hide login page functionality of the plugin is enabled. | ||||
| CVE-2023-5087 | 1 Pagelayer | 1 Pagelayer | 2025-04-23 | 5.4 Medium |
| The Page Builder: Pagelayer WordPress plugin before 1.7.8 doesn't prevent attackers with author privileges and higher from inserting malicious JavaScript inside a post's header or footer code. | ||||
| CVE-2023-51771 | 1 Starnight | 1 Micro Http Server | 2025-04-23 | 9.8 Critical |
| In MicroHttpServer (aka Micro HTTP Server) through a8ab029, _ParseHeader in lib/server.c allows a one-byte recv buffer overflow via a long URI. | ||||
| CVE-2023-51707 | 1 Arraynetworks | 3 Ag, Arrayos Ag, Vxag | 2025-04-23 | 9.8 Critical |
| MotionPro in Array ArrayOS AG before 9.4.0.505 on AG and vxAG allows remote command execution via crafted packets. AG and vxAG 9.3.0.259.x are unaffected. | ||||
| CVE-2023-4950 | 1 Funnelforms | 1 Funnelforms | 2025-04-23 | 6.1 Medium |
| The Interactive Contact Form and Multi Step Form Builder WordPress plugin before 3.4 does not sanitise and escape some parameters, which could allow unauthenticated users to perform Cross-Site Scripting attacks | ||||
| CVE-2023-4827 | 1 Ninjateam | 1 Filester | 2025-04-23 | 8.8 High |
| The File Manager Pro WordPress plugin before 1.8 does not properly check the CSRF nonce in the `fs_connector` AJAX action. This allows attackers to make highly privileged users perform unwanted file system actions via CSRF attacks by using GET requests, such as uploading a web shell. | ||||
| CVE-2023-4823 | 1 Prasadkirpekar | 1 Wp Meta And Date Remover | 2025-04-23 | 5.4 Medium |
| The WP Meta and Date Remover WordPress plugin before 2.2.0 provides an AJAX endpoint for configuring the plugin settings. This endpoint has no capability checks and does not sanitize the user input, which is then later output unescaped. Allowing any authenticated users, such as subscriber change them and perform Stored Cross-Site Scripting. | ||||
| CVE-2023-4821 | 1 Codedropz | 1 Drag And Drop Multiple File Uploader | 2025-04-23 | 5.4 Medium |
| The Drag and Drop Multiple File Upload for WooCommerce WordPress plugin before 1.1.1 does not filter all potentially dangerous file extensions. Therefore, an attacker can upload unsafe .shtml or .svg files containing malicious scripts. | ||||
| CVE-2023-4819 | 1 Tammersoft | 1 Shared Files | 2025-04-23 | 6.1 Medium |
| The Shared Files WordPress plugin before 1.7.6 does not return the right Content-Type header for the specified uploaded file. Therefore, an attacker can upload an allowed file extension injected with malicious scripts. | ||||
| CVE-2023-4811 | 1 Iptanus | 1 Wordpress File Upload | 2025-04-23 | 5.4 Medium |
| The WordPress File Upload WordPress plugin before 4.23.3 does not sanitise and escape some of its settings, which could allow high privilege users such as contributors to perform Stored Cross-Site Scripting attacks. | ||||
| CVE-2023-4805 | 1 Themeum | 1 Tutor Lms | 2025-04-23 | 5.4 Medium |
| The Tutor LMS WordPress plugin before 2.3.0 does not sanitise and escape some of its settings, which could allow users such as subscriber to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) | ||||
| CVE-2023-4795 | 1 Sazzadh | 1 Testimonial Slider Shortcode | 2025-04-23 | 5.4 Medium |
| The Testimonial Slider Shortcode WordPress plugin before 1.1.9 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin | ||||
| CVE-2023-4783 | 1 Hoosoft | 1 Magee Shortcodes | 2025-04-23 | 5.4 Medium |
| The Magee Shortcodes WordPress plugin through 2.1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. | ||||
| CVE-2023-4691 | 1 Booking-wp-plugin | 1 Bookly | 2025-04-23 | 7.2 High |
| The WordPress Online Booking and Scheduling Plugin WordPress plugin before 22.4 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin | ||||
| CVE-2023-4687 | 1 Pagelayer | 1 Pagelayer | 2025-04-23 | 6.1 Medium |
| The Page Builder: Pagelayer WordPress plugin before 1.7.7 doesn't prevent unauthenticated attackers from updating a post's header or footer code on scheduled posts. | ||||
| CVE-2023-4666 | 1 10web | 1 Form Maker | 2025-04-23 | 9.8 Critical |
| The Form Maker by 10Web WordPress plugin before 1.15.20 does not validate signatures when creating them on the server from user input, allowing unauthenticated users to create arbitrary files and lead to RCE | ||||
| CVE-2023-4646 | 1 Sayandatta | 1 Simple Posts Ticker | 2025-04-23 | 5.4 Medium |
| The Simple Posts Ticker WordPress plugin before 1.1.6 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. | ||||
| CVE-2023-4643 | 1 Shortpixel | 1 Enable Media Replace | 2025-04-23 | 8.8 High |
| The Enable Media Replace WordPress plugin before 4.1.3 unserializes user input via the Remove Background feature, which could allow Author+ users to perform PHP Object Injection when a suitable gadget is present on the blog | ||||
| CVE-2023-4521 | 1 Mooveagency | 1 Import Xml And Rss Feeds | 2025-04-23 | 9.8 Critical |
| The Import XML and RSS Feeds WordPress plugin before 2.1.5 contains a web shell, allowing unauthenticated attackers to perform RCE. The plugin/vendor was not compromised and the files are the result of running a PoC for a previously reported issue (https://wpscan.com/vulnerability/d4220025-2272-4d5f-9703-4b2ac4a51c42) and not deleting the created files when releasing the new version. | ||||