Wordfence Intelligence Weekly WordPress Vulnerability Report (Mar 13, 2023 to Mar 19, 2023)

Last week, there were 92 vulnerabilities disclosed in 76 WordPress Plugins and 7 WordPress themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 34 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.

Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to make the internet more secure. That is why the Wordfence Intelligence user interface and vulnerability API are completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

New Firewall Rules Deployed Last Week

The Wordfence Threat Intelligence Team reviews each vulnerability to determine impact and severity, along with assessing the likelihood of exploitation, to verify that the Wordfence Firewall provides sufficient protection.

The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium, Care, and Response customers last week:

UpdraftPlus 1.22.14 to 1.23.2 and UpdraftPlus (Premium) 2.22.14 to 2.23.2 – Privilege Escalation via updraft_central_ajax_handler
WAF-RULE-565 – Data redacted while we work with the developer to ensure the vulnerability protected by this WAF rule gets patched.

Wordfence Premium, Care, and Response customers received this protection immediately, while users still running the free version of Wordfence will receive this enhanced protection after a 30 day delay.

Total Unpatched & Patched Vulnerabilities Last Week

Patch Status
Number of Vulnerabilities

Unpatched
44

Patched
48

Total Vulnerabilities by CVSS Severity Last Week

Severity Rating
Number of Vulnerabilities

Low Severity
0

Medium Severity
80

High Severity
11

Critical Severity
1

Total Vulnerabilities by CWE Type Last Week

Vulnerability Type by CWE
Number of Vulnerabilities

Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)
37

Cross-Site Request Forgery (CSRF)
34

Missing Authorization
13

Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’)
3

Information Exposure
3

Server-Side Request Forgery (SSRF)
1

Improper Control of Filename for Include/Require Statement in PHP Program (‘PHP Remote File Inclusion’)
1

Researchers That Contributed to WordPress Security Last Week

Researcher Name
Number of Vulnerabilities

Lana Codes
10

Mika
4

yuyudhn
3

Cat
2

TEAM WEBoB of BoB 11th
2

Bhuvanesh Jayaprakash
1

Erwan LR
1

Etan Imanol Castro Aldrete
1

dc11
1

Brandon James Roldan
1

Pavak Tiwari
1

n0paew
1

Fariq Fadillah Gusti Insani
1

Le Ngoc Anh
1

Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and obtain a CVE ID through this form. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.

WordPress Plugins with Reported Vulnerabilities Last Week

Software Name
Software Slug

Admin side data storage for Contact Form 7
admin-side-data-storage-for-contact-form-7

Auto Rename Media On Upload
auto-rename-media-on-upload

Backup Bank: WordPress Backup Plugin
wp-backup-bank

Be POPIA Compliant
be-popia-compliant

Branda – White Label WordPress, Custom Login Page Customizer
branda-white-labeling

Bulk Resize Media
bulk-resize-media

CF7 Invisible reCAPTCHA
cf7-invisible-recaptcha

CMS Press
cms-press

Calendar Event Multi View
cp-multi-view-calendar

Chronoforms
chronoforms

Contact Form 7 Redirect & Thank You Page
cf7-redirect-thank-you-page

Contact Form 7 – PayPal & Stripe Add-on
contact-form-7-paypal-add-on

Contact Form Email
contact-form-to-email

Custom Options Plus
custom-options-plus

Customify – Intuitive Website Styling
customify

Data Tables Generator by Supsystic
data-tables-generator-by-supsystic

Drag and Drop Multiple File Upload PRO – Contact Form 7 Standard
drag-n-drop-upload-cf7-pro

Dynamics 365 Integration
integration-dynamics

Easy Event calendar
easy-event-calendar

Ecwid Ecommerce Shopping Cart
ecwid-shopping-cart

Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files
embed-any-document

Event Manager and Tickets Selling Plugin for WooCommerce
mage-eventpress

Exxp
exxp-wp

Fluid Checkout for WooCommerce – Lite
fluid-checkout

Force First and Last Name as Display Name
force-first-last

Google XML Sitemap for Images
google-image-sitemap

Google XML Sitemap for Videos
xml-sitemaps-for-videos

HT Feed
ht-instagram

Hotel Booking Lite
motopress-hotel-booking-lite

Import External Images
import-external-images

Klaviyo
klaviyo

Modern Events Calendar Lite
modern-events-calendar-lite

Modern Footnotes
modern-footnotes

Open RDW kenteken voertuiginformatie
open-rdw-kenteken-voertuiginformatie

PB SEO Friendly Images
pb-seo-friendly-images

PhonePe Payment Solutions
phonepe-payment-solutions

Photo Gallery, Images, Slider in Rbs Image Gallery
robo-gallery

Popup Maker – Popup for opt-ins, lead gen, & more
popup-maker

Print Invoice & Delivery Notes for WooCommerce
woocommerce-delivery-notes

RapidLoad Power-Up for Autoptimize
unusedcss

Redirection
redirect-redirection

Return and Warranty Management System for WooCommerce
wc-return-warrranty

Reusable Blocks Extended
reusable-blocks-extended

SEO Plugin by Squirrly SEO
squirrly-seo

SMTP2GO – Email Made Easy
smtp2go

Shopping Cart & eCommerce Store
wp-easycart

Site Reviews
site-reviews

Slide Anything – Responsive Content / HTML Slider and Carousel
slide-anything

Slideshow Gallery LITE
slideshow-gallery

Solidres – Hotel booking plugin for WordPress
solidres

Store Locator for WordPress with Google Maps – LotsOfLocales
store-locator

Surbma | GDPR Proof Cookie Consent & Notice Bar
surbma-gdpr-proof-google-analytics

Tags Cloud Manager
tags-cloud-manager

UpdraftPlus WordPress Backup Plugin
updraftplus

User Role by BestWebSoft – Add and Customize Roles and Capabilities in WordPress
user-role

WH Testimonials
wh-testimonials

WP Basic Elements
wp-basic-elements

WP Express Checkout (Accept PayPal Payments Easily)
wp-express-checkout

WP Job Portal – A Complete Job Board
wp-job-portal

WP Popup Banners
wp-popup-banners

WP Shortcode by MyThemeShop
wp-shortcode

WP Simple Events
wp-simple-events

WSB Brands
wsb-brands

Website Monetization by MageNet
website-monetization-by-magenet

WooCommerce Weight Based Shipping
weight-based-shipping-for-woocommerce

WordPress Console
wordpress-console

WordPress Email Marketing Plugin – WP Email Capture
wp-email-capture

WordPress Mortgage Calculator Estatik
estatik-mortgage-calculator

WordPress Online Booking and Scheduling Plugin – Bookly
bookly-responsive-appointment-booking-tool

WordPress Plugin for Google Maps – WP MAPS
wp-google-map-plugin

WordPress Simple Shopping Cart
wordpress-simple-paypal-shopping-cart

WordPress WP-Advanced-Search
wp-advanced-search

Yandex.News Feed by Teplitsa
yandexnews-feed-by-teplitsa

eCommerce Product Catalog Plugin for WordPress
ecommerce-product-catalog

wpml
wpml

WordPress Themes with Reported Vulnerabilities Last Week

Software Name
Software Slug

Brilliance
brilliance

Chankhe
chankhe

Mediciti Lite
mediciti-lite

NewsMag
newsmag

Real Estate Directory
real-estate-directory

Regina Lite
regina-lite

intrepidity
intrepidity

Vulnerability Details

Be POPIA Compliant <= 1.2.0 – Unauthenticated SQL Injection

Affected Software: Be POPIA Compliant
CVE ID: CVE-2022-47445
CVSS Score: 9.8 (Critical)
Researcher/s: TEAM WEBoB of BoB 11th
Patch Status: Unpatched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/eecd1497-c94e-4f67-8cc5-72afffe9fae2

Intrepidity <= 1.5.1 – Cross-Site Request Forgery via mytheme_add_admin

Affected Software: intrepidity
CVE ID: CVE-2023-27634
CVSS Score: 8.8 (High)
Researcher/s: Dave Jong
Patch Status: Unpatched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/01cc613a-d0b5-4c8f-8961-8f8aaf63b8ac

UpdraftPlus 1.22.14 to 1.23.2 and UpdraftPlus (Premium) 2.22.14 to 2.23.2 – Privilege Escalation via updraft_central_ajax_handler

Affected Software: UpdraftPlus WordPress Backup Plugin
CVE ID: CVE Unknown
CVSS Score: 8.8 (High)
Researcher/s: Unknown
Patch Status: Patched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/2e329432-c404-4312-969b-42cac345637d

WP Popup Banners <= 1.2.5 – Authenticated (Subscriber+) SQL Injection

Affected Software: WP Popup Banners
CVE ID: CVE-2023-1471
CVSS Score: 8.8 (High)
Researcher/s: Etan Imanol Castro Aldrete
Patch Status: Unpatched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/8281cb20-73d3-4ab5-910e-d353b2a5cbd8

User Role by BestWebSoft <= 1.6.6 – Cross-Site Request Forgery to Privilege Escalation

Affected Software: User Role by BestWebSoft – Add and Customize Roles and Capabilities in WordPress
CVE ID: CVE-2023-0820
CVSS Score: 8.8 (High)
Researcher/s: dc11
Patch Status: Patched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/8b4bc525-a21f-46f2-895a-c8474f72eb92

WordPress Email Marketing Plugin – WP Email Capture <= 3.10 – Missing Authorization to Email Capture List Download

Affected Software: WordPress Email Marketing Plugin – WP Email Capture
CVE ID: CVE Unknown
CVSS Score: 8.2 (High)
Researcher/s: Unknown
Patch Status: Patched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/a41d78b9-9bdb-48dd-b3ec-2559e79fa251

Admin side data storage for Contact Form 7 <= 1.1.1 – Unauthenticated Stored Cross-Site Scripting

Affected Software: Admin side data storage for Contact Form 7
CVE ID: CVE-2023-24420
CVSS Score: 7.2 (High)
Researcher/s: Bhuvanesh Jayaprakash
Patch Status: Unpatched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/172b2191-6595-47dd-bf2d-97dc3d17e5ca

Tags Cloud Manager <= 1.0.0 – Unauthenticated Stored Cross-Site Scripting

Affected Software: Tags Cloud Manager
CVE ID: CVE-2023-28166
CVSS Score: 7.2 (High)
Researcher/s: Nithissh S
Patch Status: Unpatched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/6ad70391-7ea0-49c0-ac5c-ecf7ddb3c948

Shopping Cart & eCommerce Store <= 5.4.2 – Authenticated (Admin+) Local File Inclusion via import_file_url

Affected Software: Shopping Cart & eCommerce Store
CVE ID: CVE-2023-1124
CVSS Score: 7.2 (High)
Researcher/s: Shreya Pohekar
Patch Status: Patched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/936e753b-b3e9-43c9-8686-c610faa8b20e

WH Testimonials <= 3.0.0 – Unauthenticated Stored Cross-Site Scripting

Affected Software: WH Testimonials
CVE ID: CVE-2023-1372
CVSS Score: 7.2 (High)
Researcher/s: Daniel Kelley
Patch Status: Unpatched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/b6fe5f1a-787e-4662-915f-c6f04961e194

Bookly <= 21.5 – Unauthenticated Stored Cross-Site Scripting via Name

Affected Software: WordPress Online Booking and Scheduling Plugin – Bookly
CVE ID: CVE-2023-1172
CVSS Score: 7.2 (High)
Researcher/s: Vinay Kumar
Patch Status: Patched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/c3efbd9d-e2b5-4915-a964-29a49c7fba86

Return and Warranty Management System for WooCommerce <= 1.2.3 – Unauthenticated Stored Cross-Site Scripting

Affected Software: Return and Warranty Management System for WooCommerce
CVE ID: CVE-2023-22710
CVSS Score: 7.2 (High)
Researcher/s: Le Ngoc Anh
Patch Status: Unpatched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/fa1e6527-d874-4003-b36b-5769c2950864

Slideshow Gallery LITE <= 1.7.6 – Authenticated(Admin+) SQL Injection

Affected Software: Slideshow Gallery LITE
CVE ID: CVE-2023-28491
CVSS Score: 6.5 (Medium)
Researcher/s: minhtuanact
Patch Status: Patched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/61b07604-b206-4f13-b25f-7a6d54236eb1

Exxp <= 2.6.8 – Authenticated (Subscriber+) Stored Cross-Site Scripting

Affected Software: Exxp
CVE ID: CVE-2022-45812
CVSS Score: 6.4 (Medium)
Researcher/s: Aman Rawat
Patch Status: Unpatched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/0de75f3f-1e6b-42ea-9f08-54c32e37b4c7

Slide Anything <= 2.4.7 – Authenticated (Author+) Stored Cross-Site Scripting

Affected Software: Slide Anything – Responsive Content / HTML Slider and Carousel
CVE ID: CVE-2023-28499
CVSS Score: 6.4 (Medium)
Researcher/s: FearZzZz
Patch Status: Unpatched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/130b069d-d224-44af-b2b4-26be7e081f6b

Surbma | GDPR Proof Cookie Consent & Notice Bar <= 17.5.3 – Authenticated (Contributor+) Stored Cross-Site Scripting

Affected Software: Surbma | GDPR Proof Cookie Consent & Notice Bar
CVE ID: CVE-2023-23894
CVSS Score: 6.4 (Medium)
Researcher/s: yuyudhn
Patch Status: Unpatched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/48b9f3e3-b7fd-4d7c-8f8b-b11ed977aa92

Robo Gallery <= 3.2.12 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodes

Affected Software: Photo Gallery, Images, Slider in Rbs Image Gallery
CVE ID: CVE-2023-27620
CVSS Score: 6.4 (Medium)
Researcher/s: Rafshanzani Suhada
Patch Status: Patched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/4e0424f8-f60f-49c3-9969-a88c830dc0e2

Ecwid Shopping Cart <= 6.11.4 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

Affected Software: Ecwid Ecommerce Shopping Cart
CVE ID: CVE-2023-24408
CVSS Score: 6.4 (Medium)
Researcher/s: Lana Codes
Patch Status: Patched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/c8c530e2-ce42-40f3-82ab-1df9089a5407

Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files <= 2.7.1 – Authenticated (Author+) Stored Cross-Site Scripting via SVG files

Affected Software: Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files
CVE ID: CVE-2023-23707
CVSS Score: 6.4 (Medium)
Researcher/s: n0paew
Patch Status: Patched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/eebe37bf-2983-47c0-afd8-0aa3e7982196

WP Job Portal <= 1.1.9 – Authenticated (Subscriber+) Stored Cross-Site Scripting

Affected Software: WP Job Portal – A Complete Job Board
CVE ID: CVE-2023-28534
CVSS Score: 6.4 (Medium)
Researcher/s: Fariq Fadillah Gusti Insani
Patch Status: Unpatched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/f11ea6b2-1225-42a5-aa7b-260315d0bec5

RapidLoad Power-Up for Autoptimize <= 1.7.1 – Cross-Site Request Forgery

Affected Software: RapidLoad Power-Up for Autoptimize
CVE ID: CVE-2023-1472
CVSS Score: 6.3 (Medium)
Researcher/s: Marco Wotschka
Patch Status: Patched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/8f9ee168-82b1-4d13-a84e-379f16dcb283

SEO Plugin by Squirrly SEO <= 12.1.20 – Missing Authorization

Affected Software: SEO Plugin by Squirrly SEO
CVE ID: CVE-2022-44626
CVSS Score: 6.3 (Medium)
Researcher/s: Rafie Muhammad
Patch Status: Patched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/9251afbb-1a6d-40c6-b62e-a8866742f669

Data Tables Generator by Supsystic <= 1.10.25 – Missing Authorization

Affected Software: Data Tables Generator by Supsystic
CVE ID: CVE-2023-25043
CVSS Score: 6.3 (Medium)
Researcher/s: Rafshanzani Suhada
Patch Status: Unpatched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/ae98e3bd-f663-4609-92ed-ed0431047d85

Open RDW kenteken voertuiginformatie <= 2.0.14 – Reflected Cross-Site Scripting via open_data_rdw_kenteken

Affected Software: Open RDW kenteken voertuiginformatie
CVE ID: CVE-2022-47431
CVSS Score: 6.1 (Medium)
Researcher/s: minhtuanact
Patch Status: Patched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/1fa87357-09c0-4e99-8ceb-41a7987c4a57

Solidres <= 0.9.4 – Reflected Cross-Site Scripting

Affected Software: Solidres – Hotel booking plugin for WordPress
CVE ID: CVE-2023-1377
CVSS Score: 6.1 (Medium)
Researcher/s: Erwan LR
Patch Status: Unpatched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/36d9e9cd-7885-4127-b62c-ee0b3aad8846

SEO Plugin by Squirrly SEO <= 12.1.20 – Reflected Cross-Site Scripting via ‘page’ and ‘tab’

Affected Software: SEO Plugin by Squirrly SEO
CVE ID: CVE-2022-45065
CVSS Score: 6.1 (Medium)
Researcher/s: Rafie Muhammad
Patch Status: Patched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/3edce64d-13c2-454a-b5da-0454453f69cb

WordPress Mortgage Calculator Estatik <= 2.0.7 – Reflected Cross-Site Scripting

Affected Software: WordPress Mortgage Calculator Estatik
CVE ID: CVE-2023-28490
CVSS Score: 6.1 (Medium)
Researcher/s: minhtuanact
Patch Status: Unpatched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/5ce9dd21-3c89-4ddd-9022-f1edf1224e2d

Drag and Drop Multiple File Upload PRO – Contact Form 7 Standard <= 2.11.0 – Reflected Cross-Site Scripting

Affected Software: Drag and Drop Multiple File Upload PRO – Contact Form 7 Standard
CVE ID: CVE Unknown
CVSS Score: 6.1 (Medium)
Researcher/s: Unknown
Patch Status: Patched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/60ae8b8f-bc65-40df-b6ae-4ec8e328dbe5

WPML <= 4.6.1 – Cross-Site Scripting

Affected Software: wpml
CVE ID: CVE Unknown
CVSS Score: 6.1 (Medium)
Researcher/s: Unknown
Patch Status: Patched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/b5639c00-f34c-45e3-8ff1-dfde7856a80e

Brilliance <= 1.3.1 – Reflected Cross-Site Scripting

Affected Software: Brilliance
CVE ID: CVE-2023-28171
CVSS Score: 6.1 (Medium)
Researcher/s: Dave Jong
Patch Status: Unpatched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/e5726c70-c2c7-45b9-bd03-38cf1320646a

Mediciti Lite <= 1.3.0 – Reflected Cross-Site Scripting

Affected Software: Mediciti Lite
CVE ID: CVE-2023-28418
CVSS Score: 6.1 (Medium)
Researcher/s: Dave Jong
Patch Status: Unpatched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/ec2825b2-c8df-40fd-b44d-a840be66446f

Dynamics 365 Integration <= 1.3.12 – Missing Authorization via wp_ajax_wpcrm_log & wp_ajax_wpcrm_log_verbosity

Affected Software: Dynamics 365 Integration
CVE ID: CVE-2023-28417
CVSS Score: 5.4 (Medium)
Researcher/s: Lana Codes
Patch Status: Patched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/1671e437-09f0-46bc-87ef-3a5712c3dc98

Force First and Last Name as Display Name <= 1.2 – Cross-Site Request Forgery

Affected Software: Force First and Last Name as Display Name
CVE ID: CVE-2023-28419
CVSS Score: 5.4 (Medium)
Researcher/s: Mika
Patch Status: Patched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/27d579d5-a4d2-45f7-a7bb-8f384d851d7a

WP Google Map Plugin <= 4.4.2 – Cross-Site Request Forgery via delete()

Affected Software: WordPress Plugin for Google Maps – WP MAPS
CVE ID: CVE-2023-28172
CVSS Score: 5.4 (Medium)
Researcher/s: Rafie Muhammad
Patch Status: Patched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/71f58781-3fb3-4eba-8e5a-f98f006f4607

Redirect Redirection <= 1.1.4 – Cross-Site Request Forgery to Plugin De-Installation

Affected Software: Redirection
CVE ID: CVE Unknown
CVSS Score: 5.4 (Medium)
Researcher/s: Unknown
Patch Status: Patched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/7d500729-3b1a-4ece-81de-4c1f9afbf798

Regina Lite <= 2.0.7 – Reflected Cross-Site Scripting

Affected Software: Regina Lite
CVE ID: CVE-2023-27619
CVSS Score: 5.4 (Medium)
Researcher/s: Dave Jong
Patch Status: Unpatched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/7dcd3452-a340-44e5-b292-347dc69ab863

WooCommerce Weight Based Shipping <= 5.4.1 – Cross-Site Request Forgery leading to Plugin Settings Changes

Affected Software: WooCommerce Weight Based Shipping
CVE ID: CVE-2022-46794
CVSS Score: 5.4 (Medium)
Researcher/s: Muhammad Daffa
Patch Status: Unpatched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/b5086b8d-6c74-4970-9937-5ddc5b528495

Site Reviews <= 6.5.1 – Missing Authorization

Affected Software: Site Reviews
CVE ID: CVE-2023-27625
CVSS Score: 5.4 (Medium)
Researcher/s: Rafshanzani Suhada
Patch Status: Patched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/d94f6cdd-8232-4e0c-b510-0e755c280b58

Newsmag <= 2.4.4 – Reflected Cross-Site Scripting

Affected Software: NewsMag
CVE ID: CVE-2023-28493
CVSS Score: 5.4 (Medium)
Researcher/s: Brandon James Roldan
Patch Status: Unpatched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/debe6f54-0f56-4bc9-a0cd-4f2caa1ed9e3

WordPress Email Marketing Plugin – WP Email Capture <= 3.10 – Information Exposure via wp_email_capture_options_process

Affected Software: WordPress Email Marketing Plugin – WP Email Capture
CVE ID: CVE-2023-28421
CVSS Score: 5.3 (Medium)
Researcher/s: Nguyen Anh Tien
Patch Status: Patched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/b4570948-1625-44b3-8af6-73765d9710ee

Popup Maker <= 1.17.1 – Sensitive Data Exposure via debug log file

Affected Software: Popup Maker – Popup for opt-ins, lead gen, & more
CVE ID: CVE-2022-47597
CVSS Score: 5.3 (Medium)
Researcher/s: rezaduty
Patch Status: Patched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/d0240b35-72d0-4943-84cd-5d1574609b36

Backup Bank: WordPress Backup Plugin <= 4.0.28 – Missing Authorization via post_user_feedback_backup_bank

Affected Software: Backup Bank: WordPress Backup Plugin
CVE ID: CVE-2023-28165
CVSS Score: 5.3 (Medium)
Researcher/s: Lana Codes
Patch Status: Unpatched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/e5ab6dcd-ef22-4fea-9e35-9358ede3ff5d

WP Simple Shopping Cart <= 4.6.3 – Information Disclosure

Affected Software: WordPress Simple Shopping Cart
CVE ID: CVE-2023-1431
CVSS Score: 5.3 (Medium)
Researcher/s: Ayoub Safa
Patch Status: Patched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/ea4453bc-557b-4abf-85c6-4aecfd8f4012

WordPress Console <= 0.3.9 – Missing Authorization via reload.php

Affected Software: WordPress Console
CVE ID: CVE-2023-28168
CVSS Score: 5.3 (Medium)
Researcher/s: Prasanna V Balaji
Patch Status: Unpatched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/fd3cd605-6292-4a04-9aee-f4b9a8127e8e

PhonePe Payment Solutions <= 1.0.15 – Authenticated (Subscriber+) Server-Side Request Forgery

Affected Software: PhonePe Payment Solutions
CVE ID: CVE-2022-45835
CVSS Score: 5 (Medium)
Researcher/s: Aman Rawat
Patch Status: Patched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/8f24f7e2-2516-4f4d-955f-f3f6001cbce7

Auto Rename Media On Upload <= 1.0.5 – Authenticated (Administrator+) Stored Cross-Site Scripting

Affected Software: Auto Rename Media On Upload
CVE ID: CVE Unknown
CVSS Score: 4.4 (Medium)
Researcher/s: Unknown
Patch Status: Patched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/25a566ed-9ed6-4c72-9728-49a0edfb5ba5

eCommerce Product Catalog plugin for WordPress <= 3.3.8 – Authenticated (Administrator+) Stored Cross-Site Scripting

Affected Software: eCommerce Product Catalog Plugin for WordPress
CVE ID: CVE-2023-1470
CVSS Score: 4.4 (Medium)
Researcher/s: Marco Wotschka
Patch Status: Patched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/26b7438e-438b-41eb-9458-2fba8ab1964d

WP Simple Events <= 1.0 – Authenticated (Administrator+) Stored Cross-Site Scripting

Affected Software: WP Simple Events
CVE ID: CVE-2023-24376
CVSS Score: 4.4 (Medium)
Researcher/s: Nithissh S
Patch Status: Unpatched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/53de68ad-76a6-4043-8369-7679c1c5c1cd

Easy Event calendar <= 1.0 – Authenticated (Administrator+) Stored Cross-Site Scripting

Affected Software: Easy Event calendar
CVE ID: CVE-2023-28169
CVSS Score: 4.4 (Medium)
Researcher/s: Nithissh S
Patch Status: Unpatched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/57dda8e6-54d1-41db-a54d-4a5d635e23b7

Yandex.News Feed by Teplitsa <= 1.12.5 – Authenticated (Administrator+) Stored Cross-Site Scripting

Affected Software: Yandex.News Feed by Teplitsa
CVE ID: CVE-2023-25052
CVSS Score: 4.4 (Medium)
Researcher/s: yuyudhn
Patch Status: Unpatched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/756810c0-d805-4391-a67b-19b40597d219

SMTP2GO <= 1.4.2 – Authenticated (Administrator+) Stored Cross-Site Scripting via admin settings

Affected Software: SMTP2GO – Email Made Easy
CVE ID: CVE-2023-28496
CVSS Score: 4.4 (Medium)
Researcher/s: Rio Darmawan
Patch Status: Patched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/7cc618c8-63a9-4321-ad18-ee5277a5f5e0

WSB Brands <= 1.1.8 – Authenticated (Administrator+) Stored Cross-Site Scripting via $logo

Affected Software: WSB Brands
CVE ID: CVE-2022-47437
CVSS Score: 4.4 (Medium)
Researcher/s: TEAM WEBoB of BoB 11th
Patch Status: Patched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/89321887-0116-47fb-b65b-008c9fb01b62

PB SEO Friendly Images <= 4.0.5 – Authenticated (Administrator+) Stored Cross-Site Scripting

Affected Software: PB SEO Friendly Images
CVE ID: CVE-2022-47434
CVSS Score: 4.4 (Medium)
Researcher/s: Dimas Aprilianto
Patch Status: Unpatched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/89fc8407-3d1f-4b1b-9b4c-13c0da928231

CMS Press <= 0.2.3 – Authenticated (Administrator+) Stored Cross-Site Scripting

Affected Software: CMS Press
CVE ID: CVE-2023-25452
CVSS Score: 4.4 (Medium)
Researcher/s: Prasanna V Balaji
Patch Status: Unpatched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/905cb57b-70ec-4324-ae66-9c06d1737939

Modern Footnotes <= 1.4.15 – Authenticated (Administrator+) Stored Cross-Site Scripting

Affected Software: Modern Footnotes
CVE ID: CVE-2023-28423
CVSS Score: 4.4 (Medium)
Researcher/s: Rio Darmawan
Patch Status: Patched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/94b98842-8c75-4623-8cc9-ad3dc0916a18

Solidres <= 0.9.4 – Authenticated (Admin+) Stored Cross-Site Scripting

Affected Software: Solidres – Hotel booking plugin for WordPress
CVE ID: CVE-2023-1374
CVSS Score: 4.4 (Medium)
Researcher/s: Daniel Kelley
Patch Status: Unpatched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/b13ee51b-9f23-428f-9cef-4a9b9b06b0c4

WP Express Checkout <= 2.2.8 – Authenticated (Admin+) Stored Cross-Site Scripting via pec_coupon

Affected Software: WP Express Checkout (Accept PayPal Payments Easily)
CVE ID: CVE-2023-1469
CVSS Score: 4.4 (Medium)
Researcher/s: Ayoub Safa
Patch Status: Patched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/b35ee801-f04d-4b22-8238-053b02a6ee0c

Branda – White Label WordPress <= 3.4.8.1 – Authenticated (Administrator+) Stored Cross-Site Scripting

Affected Software: Branda – White Label WordPress, Custom Login Page Customizer
CVE ID: CVE Unknown
CVSS Score: 4.4 (Medium)
Researcher/s: Unknown
Patch Status: Patched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/c3508b46-6920-48b9-9acb-620ea34e07e2

Klaviyo <= 3.0.7 – Authenticated (Administrator+) Stored Cross-Site Scripting

Affected Software: Klaviyo
CVE ID: CVE-2023-25456
CVSS Score: 4.4 (Medium)
Researcher/s: Abdi Pranata
Patch Status: Patched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/d2b66f27-e4d2-4f6e-be96-b7f967a30885

Modern Events Calendar lite <= 5.16.2 – Authenticated (Admin+) Stored Cross-Site Scripting

Affected Software: Modern Events Calendar Lite
CVE ID: CVE-2023-1400
CVSS Score: 4.4 (Medium)
Researcher/s: Pavak Tiwari
Patch Status: Unpatched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/e7465ca4-21e8-4935-b294-e7378b2b01a7

Slideshow Gallery LITE <= 1.7.6 – Cross-Site Request Forgery via admin_galleries

Affected Software: Slideshow Gallery LITE
CVE ID: CVE-2023-28497
CVSS Score: 4.3 (Medium)
Researcher/s: Rio Darmawan
Patch Status: Patched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/0a598274-3c67-4751-94d6-49abed38422c

Google XML Sitemap for Images <= 2.1.3 – Cross-Site Request Forgery via image_sitemap_generate

Affected Software: Google XML Sitemap for Images
CVE ID: CVE-2023-28173
CVSS Score: 4.3 (Medium)
Researcher/s: Rio Darmawan
Patch Status: Unpatched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/1165c68d-3da4-45f3-b054-4904e54d18ac

Slideshow Gallery LITE <= 1.7.6 – Cross-Site Request Forgery via admin_slides

Real Estate Directory <= 1.0.4 – Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Activation

Affected Software: Real Estate Directory
CVE ID: CVE-2023-28532
CVSS Score: 4.3 (Medium)
Researcher/s: Dave Jong
Patch Status: Patched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/17031e21-e697-4e01-8848-c3957f5dac7f

LOGIN AND REGISTRATION ATTEMPTS LIMIT <= 2.1 – Cross-Site Request Forgery

Affected Software: LOGIN AND REGISTRATION ATTEMPTS LIMIT
CVE ID: CVE-2022-47138
CVSS Score: 4.3 (Medium)
Researcher/s: rezaduty
Patch Status: Unpatched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/257052f4-2b0a-4604-befd-651dc338b3d5

Chronoforms <= 7.0.9 – Cross-Site Request Forgery

Affected Software: Chronoforms
CVE ID: CVE-2022-47135
CVSS Score: 4.3 (Medium)
Researcher/s: rezaduty
Patch Status: Unpatched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/2c02b9b2-b41e-4a30-b69a-9cdae86dd7a7

Real Estate Directory <= 1.0.5 – Cross-Site Request Forgery via rdm_activate_plugin

Affected Software: Real Estate Directory
CVE ID: CVE-2023-28532
CVSS Score: 4.3 (Medium)
Researcher/s: Unknown
Patch Status: Patched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/39a50c49-5c24-4ae7-8f77-4f3d98270f8f

CP Multi View Event Calendar <= 1.4.10 – Missing Authentication leading to Authenticated (Subscriber+) Private Form Submission

Affected Software: Calendar Event Multi View
CVE ID: CVE-2023-28492
CVSS Score: 4.3 (Medium)
Researcher/s: Lana Codes
Patch Status: Patched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/49ebff14-ce09-4607-8246-50ae028957f6

Customify <= 2.10.4 – Cross-Site Request Forgery to Settings Update

Affected Software: Customify – Intuitive Website Styling
CVE ID: CVE-2023-27633
CVSS Score: 4.3 (Medium)
Researcher/s: Mika
Patch Status: Patched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/4b1c0ee5-5329-411c-8030-14bec586d74d

Fluid Checkout for WooCommerce – Lite <= 2.3.1 – Cross-Site Request Forgery via dismiss_notice

Affected Software: Fluid Checkout for WooCommerce – Lite
CVE ID: CVE Unknown
CVSS Score: 4.3 (Medium)
Researcher/s: Unknown
Patch Status: Patched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/5c8caf17-7844-4f26-b989-d29593b3ffda

Website Monetization by MageNet <= 1.0.29.1 – Cross-Site Request Forgery via admin_magenet_settings

Affected Software: Website Monetization by MageNet
CVE ID: CVE-2023-22673
CVSS Score: 4.3 (Medium)
Researcher/s: Mika
Patch Status: Unpatched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/5f1f3562-f869-4442-b77f-c06c5683c1b2

Bulk Resize Media <= 1.1 – Cross-Site Request Forgery via bulk_resize_resize_image

Affected Software: Bulk Resize Media
CVE ID: CVE-2022-46865
CVSS Score: 4.3 (Medium)
Researcher/s: Cat
Patch Status: Unpatched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/605fbfb9-85d8-43ff-a738-ad1a8a9584c3

Import External Images <= 1.4 – Cross-Site Request Forgery via [placeholder]

Affected Software: Import External Images
CVE ID: CVE-2022-46866
CVSS Score: 4.3 (Medium)
Researcher/s: Cat
Patch Status: Unpatched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/6785be1c-85d4-48f1-be15-275c71284b3e

Reusable Blocks Extended <= 0.9 – Cross-Site Request Forgery via reblex_reusable_screen_block_pattern_registration

Affected Software: Reusable Blocks Extended
CVE ID: CVE-2023-27611
CVSS Score: 4.3 (Medium)
Researcher/s: Rio Darmawan
Patch Status: Patched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/67c2cac8-c3cf-46d1-a592-229081bc31e1

WP Shortcode by MyThemeShop <= 1.4.16 – Cross-Site Request Forgery

Affected Software: WP Shortcode by MyThemeShop
CVE ID: CVE-2023-28495
CVSS Score: 4.3 (Medium)
Researcher/s: Lana Codes
Patch Status: Unpatched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/763fec04-72c5-4910-af97-f58b5b69a02e

WP Basic Elements <= 5.2.15 – Cross-Site Request Forgery via wpbe_save_settings

Affected Software: WP Basic Elements
CVE ID: CVE-2022-47139
CVSS Score: 4.3 (Medium)
Researcher/s: rezaduty
Patch Status: Unpatched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/78e79423-7b69-4d85-a939-96eb5385624c

Dynamics 365 Integration <= 1.3.12 – Cross-Site Request Forgery via wp_ajax_wpcrm_log

Affected Software: Dynamics 365 Integration
CVE ID: CVE Unknown
CVSS Score: 4.3 (Medium)
Researcher/s: Unknown
Patch Status: Patched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/7945110e-2a9d-4e0e-b0e8-77c16694993b

Hotel Booking Lite <= 4.6.0 – Cross-Site Request Forgery to Settings Update

Affected Software: Hotel Booking Lite
CVE ID: CVE-2023-28498
CVSS Score: 4.3 (Medium)
Researcher/s: yuyudhn
Patch Status: Patched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/7a874287-c648-4807-8387-b0b47187651e

CF7 Invisible reCAPTCHA <= 1.3.3 – Cross-Site Request Forgery via vsz_cf7_invisible_recaptcha_page

Affected Software: CF7 Invisible reCAPTCHA
CVE ID: CVE-2023-28167
CVSS Score: 4.3 (Medium)
Researcher/s: Rio Darmawan
Patch Status: Unpatched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/8fa1048e-bdcd-41d1-a7c4-196731a60843

HT Feed <= 1.2.7 – Cross-Site Request Forgery leading to Limited Plugin Activation

Affected Software: HT Feed
CVE ID: CVE-2023-23804
CVSS Score: 4.3 (Medium)
Researcher/s: Lana Codes
Patch Status: Patched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/95723482-a6c5-4e95-a88d-c50a88108715

Contact Form Email <= 1.3.31 – Missing Authorization to Feedback Submission

Affected Software: Contact Form Email
CVE ID: CVE-2023-28494
CVSS Score: 4.3 (Medium)
Researcher/s: Lana Codes
Patch Status: Patched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/9596c243-4099-420a-aa2a-381b6299f927

Custom Options Plus <= 1.8.1 – Cross-Site Request Forgery via custom_options_plus_adm

Affected Software: Custom Options Plus
CVE ID: CVE-2023-28420
CVSS Score: 4.3 (Medium)
Researcher/s: Justiice
Patch Status: Unpatched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/97c8858a-f05d-4159-b914-4e6ae9bf0d79

Store Locator <= 3.98.7 – Cross-Site Request Forgery to Settings Update

Affected Software: Store Locator for WordPress with Google Maps – LotsOfLocales
CVE ID: CVE Unknown
CVSS Score: 4.3 (Medium)
Researcher/s: Unknown
Patch Status: Patched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/98ae3315-8361-43bb-be2c-1564f4df8d5b

Dynamics 365 Integration <= 1.3.12 – Cross-Site Request Forgery via wp_ajax_wpcrm_log_verbosity

Contact Form 7 Redirect & Thank You Page <= 1.0.3 – Cross-Site Request Forgery via cf7rl_admin_table

Affected Software: Contact Form 7 Redirect & Thank You Page
CVE ID: CVE-2023-24395
CVSS Score: 4.3 (Medium)
Researcher/s: Lana Codes
Patch Status: Unpatched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/99f831f2-fb96-4dc8-ba3d-6015fbc7e2e1

WP-Advanced-Search <= 3.3.8 – Cross-Site Request Forgery leading to Plugin Settings Updates

Affected Software: WordPress WP-Advanced-Search
CVE ID: CVE-2022-47447
CVSS Score: 4.3 (Medium)
Researcher/s: rezaduty
Patch Status: Unpatched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/a2ba21cd-d8f3-402a-b067-1758937d9eb4

Event Manager for WooCommerce <= 3.7.7 – Cross-Site Request Forgery leading to Uninstall Form Submission

Affected Software: Event Manager and Tickets Selling Plugin for WooCommerce
CVE ID: CVE-2022-47164
CVSS Score: 4.3 (Medium)
Researcher/s: Lana Codes
Patch Status: Patched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/af59eb6d-1ffa-4593-9bfc-f910d907f6e0

Contact Form 7 – PayPal & Stripe Add-on <= 1.9.3 – Cross-Site Request Forgery

Affected Software: Contact Form 7 – PayPal & Stripe Add-on
CVE ID: CVE-2023-24405
CVSS Score: 4.3 (Medium)
Researcher/s: Lana Codes
Patch Status: Unpatched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/c0c13b83-6885-46db-bf33-0b2b63ff06db

WP Basic Elements <= 5.2.15 – Missing Authorization to Plugin Settings Update via wpbe_save_settings

Affected Software: WP Basic Elements
CVE ID: CVE Unknown
CVSS Score: 4.3 (Medium)
Researcher/s: Unknown
Patch Status: Unpatched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/d6516fc0-4ef8-423b-9cdb-a275996fd98b

Print Invoice & Delivery Notes for WooCommerce <= 4.7.2 – Cross-Site Request Forgery via ts_reset_tracking_setting

Affected Software: Print Invoice & Delivery Notes for WooCommerce
CVE ID: CVE-2022-46795
CVSS Score: 4.3 (Medium)
Researcher/s: Muhammad Daffa
Patch Status: Patched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/d811782e-3b59-4a46-9a2e-f24ef3dfbd4a

Chankhe <= 1.0.5 – Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Activation

Affected Software: Chankhe
CVE ID: CVE-2023-28416
CVSS Score: 4.3 (Medium)
Researcher/s: Dave Jong
Patch Status: Unpatched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/efa4b67c-1bb8-413a-8cb8-039168b0b586

Google XML Sitemap for Videos <= 2.6.1 – Cross-Site Request Forgery via video_sitemap_generate

Affected Software: Google XML Sitemap for Videos
CVE ID: CVE-2023-25055
CVSS Score: 4.3 (Medium)
Researcher/s: Mika
Patch Status: Unpatched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/feb4f3dc-9abf-4ee3-834e-e5516652d810

As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.

This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us using our CVE Request form, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

The post Wordfence Intelligence Weekly WordPress Vulnerability Report (Mar 13, 2023 to Mar 19, 2023) appeared first on Wordfence.

Cookie	Duration	Description
_GRECAPTCHA	5 months 27 days	This cookie is set by the Google recaptcha service to identify bots to protect the website against malicious spam attacks.
cookielawinfo-checbox-analytics	11 months	This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Analytics".
cookielawinfo-checbox-functional	11 months	The cookie is set by GDPR cookie consent to record the user consent for the cookies in the category "Functional".
cookielawinfo-checbox-others	11 months	This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Other.
cookielawinfo-checkbox-advertisement	1 year	Set by the GDPR Cookie Consent plugin, this cookie is used to record the user consent for the cookies in the "Advertisement" category .
cookielawinfo-checkbox-necessary	11 months	This cookie is set by GDPR Cookie Consent plugin. The cookies is used to store the user consent for the cookies in the category "Necessary".
cookielawinfo-checkbox-performance	11 months	This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Performance".
viewed_cookie_policy	11 months	The cookie is set by the GDPR Cookie Consent plugin and is used to store whether or not user has consented to the use of cookies. It does not store any personal data.