Wordfence Intelligence Weekly WordPress Vulnerability Report (Apr 17, 2023 to Apr 23, 2023)

Last week, there were 152 vulnerabilities disclosed in 134 WordPress Plugins and 0 WordPress themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 41 Vulnerability Researchers that contributed to WordPress Security last week. There were more unpatched vulnerabilities than patched last week, so it’s more important than ever to review those vulnerabilities in this report now to ensure your site is not affected and make the appropriate adjustments if your site is.

Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to make the internet more secure. That is why the Wordfence Intelligence user interface and vulnerability API are completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

Total Unpatched & Patched Vulnerabilities Last Week

Patch Status
Number of Vulnerabilities

Unpatched
81

Patched
71

Total Vulnerabilities by CVSS Severity Last Week

Severity Rating
Number of Vulnerabilities

Low Severity
0

Medium Severity
134

High Severity
16

Critical Severity
2

Total Vulnerabilities by CWE Type Last Week

Vulnerability Type by CWE
Number of Vulnerabilities

Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)
93

Cross-Site Request Forgery (CSRF)
30

Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’)
11

Missing Authorization
10

Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’)
2

Deserialization of Untrusted Data
2

Improper Control of Filename for Include/Require Statement in PHP Program (‘PHP Remote File Inclusion’)
1

Information Exposure
1

Improper Access Control
1

URL Redirection to Untrusted Site (‘Open Redirect’)
1

Researchers That Contributed to WordPress Security Last Week

Researcher Name
Number of Vulnerabilities

Lana Codes
30

yuyudhn
7

TEAM WEBoB of BoB 11th
3

Mika
3

Cat
3

Skalucy
1

Yeting Li VARAS@IIE
1

thiennv
1

cydave
1

easyBug
1

Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and obtain a CVE ID through this form. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.

WordPress Plugins with Reported Vulnerabilities Last Week

Software Name
Software Slug

AI ChatBot
chatbot

ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup
armember-membership

Accessibility Suite by Online ADA
online-accessibility

Accordion & FAQ – Helpie WordPress Frequently Asked Questions plugin
helpie-faq

Active Directory Integration / LDAP Integration
ldap-login-for-intranet-sites

ActiveCampaign – Forms, Site Tracking, Live Chat
activecampaign-subscription-forms

Ad Inserter – Ad Manager & AdSense Ads
ad-inserter

Album Gallery – WordPress Gallery
new-album-gallery

ApexChat
apexchat

Avirato hotels online booking engine
avirato-calendar

BBSpoiler
bbspoiler

BadgeOS
badgeos

Best Travel Booking WordPress Plugin, Tour Booking System, Trip Booking WordPress Plugin – Yatra
yatra

Bitcoin / AltCoin Payment Gateway for WooCommerce & Multivendor store / shop
woo-altcoin-payment-gateway

BizLibrary
bizlibrary

Booking calendar, Appointment Booking System
booking-calendar

Button Builder – Buttons X
buttons-x

CMP – Coming Soon & Maintenance Plugin by NiteoThemes
cmp-coming-soon-maintenance

CMS Tree Page View
cms-tree-page-view

Cab Grid
cab-grid

Captcha Them All
captcha-them-all

Category Specific RSS feed Subscription
category-specific-rss-feed-menu

Church Admin
church-admin

Clock In Portal- Staff & Attendance Management
clock-in-portal

Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress
contact-form-to-db

Continuous announcement scroller
continuous-announcement-scroller

Custom Post Type List Shortcode
custom-post-type-list-shortcode

Customer Support Software, Live Chat, & Marketing Automation
formilla-chat-and-marketing

Dave’s WordPress Live Search
daves-wordpress-live-search

Donation Forms by Charitable – Donations Plugin & Fundraising Platform for WordPress
charitable

EZP Maintenance Mode
easy-pie-maintenance-mode

Easy Ad Manager
easy-ad-manager

Easy Slider Revolution
easy-slider-revolution

Ebook Store
ebook-store

Email posts to subscribers
email-posts-to-subscribers

Enable/Disable Auto Login when Register
auto-login-when-resister

Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates
essential-blocks

File Gallery
file-gallery

Flyzoo Chat
flyzoo

Form Block
form-block

FormCraft – Contact Form Builder for WordPress
formcraft-form-builder

Formilla Edge Targeted Messaging Platform for Sales and Marketing
formilla-edge

Freshdesk (official)
freshdesk-support

GDPR Compliance & Cookie Consent
gdpr-compliance-cookie-consent

Gallery Metabox
gallery-metabox

Google Analytics Top Content Widget
google-analytics-top-posts-widget

Gps Plotter
gps-plotter

Help Desk WP
helpdeskwp

Image Optimizer by 10web – Image Optimizer and Compression plugin
image-optimizer-wd

Japanized For WooCommerce
woocommerce-for-japan

Jetpack CRM – Clients, Leads, Invoices, Billing, Email Marketing, & Automation
zero-bs-crm

Kaya QR Code Generator
kaya-qr-code-generator

Kiwiz – Certification de facturation – Woocommerce
woocommerce-gateway-certification-de-facture-et-gestion-de-pdf-kiwiz

Kodex Posts likes
kodex-posts-likes

LIQUID SPEECH BALLOON
liquid-speech-balloon

Layer Slider
slider-slideshow

LearnPress Export Import – WordPress extension for LearnPress
learnpress-import-export

Live Chat by Formilla – Real-time Chat & Chatbots Plugin
formilla-live-chat

Locatoraid Store Locator
locatoraid

Mail Subscribe List
mail-subscribe-list

Mega Addons For WPBakery Page Builder
mega-addons-for-visual-composer

Membership Database
member-database

Modal Dialog
modal-dialog

Motors – Car Dealer, Classifieds & Listing
motors-car-dealership-classified-listings

NEX-Forms – Ultimate Form Builder – Contact forms and much more
nex-forms-express-wp-form-builder

Ninja Tables – Best Data Table Plugin for WordPress
ninja-tables

OoohBoi Steroids for Elementor
ooohboi-steroids-for-elementor

Panorama – WordPress Project Management Plugin
project-panorama-lite

Post Shortcode
post-shortcode

PowerPress Podcasting plugin by Blubrry
powerpress

Pretty Url
pretty-url

Product Slider For WooCommerce Lite
product-slider-for-woocommerce-lite

PropertyHive
propertyhive

Query Wrangler
query-wrangler

RapidExpCart
rapidexpcart

Redirect After Login
redirect-after-login

Reservation.Studio widget
reservation-studio-widget

Responsive Filterable Portfolio
responsive-filterable-portfolio

ReviewX – Multi-criteria Rating & Reviews for WooCommerce
reviewx

Robokassa payment gateway for Woocommerce
robokassa

Semalt Blocker
semalt

ShopEngine – Elementor WooCommerce Builder Addons, Variation Swatches, Wishlist, Products Compare – All in One Solution
shopengine

Shortcode IMDB
shortcode-imdb

Simple Share Buttons Adder
simple-share-buttons-adder

Simple Tooltips
simple-tooltips

SiteAlert – Uptime, Speed, and Security Monitoring for WordPress
my-wp-health-check

Sloth Logo Customizer
sloth-logo-customizer

Smart WooCommerce Search
smart-woocommerce-search

Social Share Boost
social-share-boost

SparkPost
sparkpost

Stock Exporter for WooCommerce
stock-exporter-for-woocommerce

Stream
stream

Subscribers – Free Web Push Notifications
subscribers-com

Tablesome – Data table & Workflow Automation ( Contact Form Entries, Email Log, OpenAI / ChatGPT )
tablesome

TaxoPress is the WordPress Tag, Category, and Taxonomy Manager
simple-tags

The School Management – Education & Learning Management
school-management-system

Themify Portfolio Post
themify-portfolio-post

Thumbnail carousel slider
wp-responsive-thumbnail-slider

Uji Popup
uji-popup

Ultimate Carousel For Elementor
ultimate-carousel-for-elementor

Ultimate Carousel For WPBakery Page Builder
ultimate-carousel-for-visual-composer

Update Image Tag Alt Attribute
update-alt-attribute

Verified Reviews (Avis Vérifiés)
netreviews

Video Grid
video-grid

Video List Manager
video-list-manager

Visual CSS Style Editor
yellow-pencil-visual-theme-customizer

WCP Contact Form
wcp-contact-form

WP Cerber Security, Anti-spam & Malware Scan
wp-cerber

WP Custom Author URL
wp-custom-author-url

WP Docs
wp-docs

WP Links Page
wp-links-page

WP Login Box
wp-login-box

WP Original Media Path
wp-original-media-path

WP Popups – WordPress Popup builder
wp-popups-lite

WP Responsive Tabs horizontal vertical and accordion Tabs
responsive-horizontal-vertical-and-accordion-tabs

WP-FormAssembly
formassembly-web-forms

WP-dTree
wp-dtree-30

WPJAM Basic
wpjam-basic

White Label Branding for Elementor Page Builder
white-label-branding-elementor

WooCommerce Easy Duplicate Product
woo-easy-duplicate-product

WooCommerce Order Status Change Notifier
woocommerce-order-status-change-notifier

Woocommerce Email Report
wooemailreport

Woocommerce Products Designer by ORION – online product customizer for t-shirts, print cards, phone cases Lettering & Decals
woocommerce-products-designer

WordPress Header Builder Plugin – Pearl
pearl-header-builder

Wp-D3
wp-d3

YARPP – Yet Another Related Posts Plugin
yet-another-related-posts-plugin

YML for Yandex Market
yml-for-yandex-market

YourChannel: Everything you want in a YouTube plugin.
yourchannel

Zendesk Support for WordPress
zendesk

eRocket
erocket

f(x) TOC
fx-toc

miniOrange’s Google Authenticator – WordPress Two Factor Authentication (2FA , Two Factor, OTP SMS and Email) | Passwordless login
miniorange-2-factor-authentication

vSlider Multi Image Slider for WordPress
vslider

Vulnerability Details

Email posts to subscribers <= 6.2 – Unauthenticated SQL Injection

Affected Software: Email posts to subscribers
CVE ID: CVE-2022-46818
CVSS Score: 9.8 (Critical)
Researcher/s: Le Ngoc Anh
Patch Status: Unpatched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/51f73041-927d-42da-92cc-14242a397356

Bitcoin / AltCoin Payment Gateway for WooCommerce <= 1.7.1 – Unauthenticated SQL Injection

Affected Software: Bitcoin / AltCoin Payment Gateway for WooCommerce & Multivendor store / shop
CVE ID: CVE-2022-4118
CVSS Score: 9.8 (Critical)
Researcher/s: cydave
Patch Status: Unpatched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/a4e1315b-31e5-428c-9a48-6185b4eeb2fc

ReviewX – Multi-criteria Rating & Reviews for WooCommerce <= 1.6.8 – Authenticated (Subscriber+) SQL Injection

Affected Software: ReviewX – Multi-criteria Rating & Reviews for WooCommerce
CVE ID: CVE-2023-26325
CVSS Score: 8.8 (High)
Researcher/s: Joshua Martinelle
Patch Status: Patched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/072092ef-17bc-4b8b-bf8b-bd69a761c56a

YARPP <= 5.30.2 – Authenticated (Subscriber+) Local File Inclusion

Affected Software: YARPP – Yet Another Related Posts Plugin
CVE ID: CVE-2022-45374
CVSS Score: 8.8 (High)
Researcher/s: Rafie Muhammad
Patch Status: Unpatched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/1091862b-784b-496f-a951-6784544cb51b

Accessibility Suite by Online ADA <= 4.11 – Authenticated (Subscriber+) SQL Injection

Affected Software: Accessibility Suite by Online ADA
CVE ID: CVE-2022-47420
CVSS Score: 8.8 (High)
Researcher/s: minhtuanact
Patch Status: Unpatched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/71c21af1-a007-4535-98ea-a6f25142bcf6

Avirato hotels online booking engine <= 5.0.5 – Authenticated (Subscriber+) SQL Injection

Affected Software: Avirato hotels online booking engine
CVE ID: CVE-2023-0768
CVSS Score: 8.8 (High)
Researcher/s: Lana Codes
Patch Status: Unpatched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/b62fb1a8-d62d-4d1f-bcce-a081432b9e61

Contact Form to DB by BestWebSoft <= 1.7.0 – Authenticated (Contributor+) SQL Injection via cntctfrmtdb_department

Affected Software: Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress
CVE ID: CVE-2023-29096
CVSS Score: 8.8 (High)
Researcher/s: easyBug
Patch Status: Patched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/ba317acb-d45c-42c0-b5fb-b163bcd59340

Kiwiz – Certification de facturation – Woocommerce <= 2.1.3 – Unauthenticated Arbitrary File Download

Affected Software: Kiwiz – Certification de facturation – Woocommerce
CVE ID: CVE-2023-2180
CVSS Score: 7.5 (High)
Researcher/s: WPScanTeam
Patch Status: Unpatched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/603f0c9d-6964-4911-b4a5-bdad24a1a8dd

miniOrange’s Google Authenticator <= 5.6.5 – Missing Authorization to Plugin Settings Change

Affected Software: miniOrange’s Google Authenticator – WordPress Two Factor Authentication (2FA , Two Factor, OTP SMS and Email) | Passwordless login
CVE ID: CVE-2022-4943
CVSS Score: 7.5 (High)
Researcher/s: Ramuel Gall
Patch Status: Patched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/7267ede1-7745-47cc-ac0d-4362140b4c23

Jetpack CRM <= 5.3.1 – Cross-Site Request Forgery and PHAR Deserialization

Affected Software: Jetpack CRM – Clients, Leads, Invoices, Billing, Email Marketing, & Automation
CVE ID: CVE-2022-3342
CVSS Score: 7.5 (High)
Researcher/s: Ramuel Gall
Patch Status: Patched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/98ab264f-b210-41d0-bb6f-b4f31d933f80

The School Management – Education & Learning Management <= 4.1 – Authenticated (Administrator+) SQL Injection

Affected Software: The School Management – Education & Learning Management
CVE ID: CVE-2022-47430
CVSS Score: 7.2 (High)
Researcher/s: minhtuanact
Patch Status: Unpatched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/1268bdb9-7f80-4fdc-a95a-d51b0ab83e17

Ad Inserter <= 2.7.25 – Authenticated (Admin+) PHP Object Injection

Affected Software: Ad Inserter – Ad Manager & AdSense Ads
CVE ID: CVE-2023-1549
CVSS Score: 7.2 (High)
Researcher/s: Nguyen Huu Do
Patch Status: Patched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/1c94028c-a774-45ac-817d-ad9b966a3b51

Shortcode IMDB <= 6.0.8 – Authenticated (Administrator+) SQL Injection

Affected Software: Shortcode IMDB
CVE ID: CVE-2022-47432
CVSS Score: 7.2 (High)
Researcher/s: minhtuanact
Patch Status: Unpatched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/3ae6bf2e-b39a-4bb3-9203-22ff4c23ddf4

WP Cerber Security <= 9.1 – Unauthenticated Stored Cross-Site Scripting

Affected Software: WP Cerber Security, Anti-spam & Malware Scan
CVE ID: CVE-2022-4712
CVSS Score: 7.2 (High)
Researcher/s: Ramuel Gall
Patch Status: Patched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/6cd9cbba-10b0-4fb0-ad49-4593a307a615

Video List Manager <= 1.7 – Authenticated (Admin+) SQL Injection

Affected Software: Video List Manager
CVE ID: CVE-2023-1408
CVSS Score: 7.2 (High)
Researcher/s: zhangyunpei, Yeting Li VARAS@IIE
Patch Status: Unpatched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/8b2d42ab-46c1-4c3e-b99a-1cdcade1b5bb

Help Desk WP <= 1.2.0 – Authenticated (Editor+) Stored Cross-Site Scripting

Affected Software: Help Desk WP
CVE ID: CVE-2023-1019
CVSS Score: 7.2 (High)
Researcher/s: Ameen Alkurdy
Patch Status: Unpatched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/8ec5173b-7b0d-4887-8c13-f48137aa8593

Booking calendar, Appointment Booking System <= 3.2.6 – Authenticated (Administrator+) SQL Injection via *_selected

Affected Software: Booking calendar, Appointment Booking System
CVE ID: CVE-2022-47428
CVSS Score: 7.2 (High)
Researcher/s: thiennv
Patch Status: Patched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/9c44b6e5-7fb2-402e-8c8c-79d811ff0e9a

NEX-Forms <= 8.3.3 – Authenticated (Administrator+) SQL Injection

Affected Software: NEX-Forms – Ultimate Form Builder – Contact forms and much more
CVE ID: CVE-2023-2114
CVSS Score: 7.2 (High)
Researcher/s: Alexander Schmid
Patch Status: Patched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/9d19be8b-3e0b-4d74-97e0-f17132d2d34c

Ebook Store <= 5.775 – Missing Authorization via ebook_store_export_orders

Affected Software: Ebook Store
CVE ID: CVE-2023-22701
CVSS Score: 6.5 (Medium)
Researcher/s: yuyudhn
Patch Status: Patched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/d4b17cce-bb52-4125-8c85-6da15517275f

f(x) TOC <= 1.1.0 – Authenticated (Contributor+) Stored Cross-Site Scripting

Affected Software: f(x) TOC
CVE ID: CVE-2023-0490
CVSS Score: 6.4 (Medium)
Researcher/s: Lana Codes
Patch Status: Unpatched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/09479df1-ff7e-4df8-9aea-8c7622ecea4e

Easy Slider Revolution <= 1.0.0 – Authenticated (Author+) Stored Cross-Site Scripting via esrcpt_slider_allow_iframes_filter

Affected Software: Easy Slider Revolution
CVE ID: CVE-2023-28622
CVSS Score: 6.4 (Medium)
Researcher/s: Yuki Haruma
Patch Status: Unpatched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/14a20f9c-cf5a-4d57-b723-ad29a12c8881

Button Builder – Buttons X <= 0.8.6 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

Affected Software: Button Builder – Buttons X
CVE ID: CVE-2023-23867
CVSS Score: 6.4 (Medium)
Researcher/s: Lana Codes
Patch Status: Unpatched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/1aea8fe3-7c75-4d3a-847a-ce0d1f9700f1

Uji Popup <= 1.4.3 – Authenticated (Contributor+) Stored Cross-Site Scripting via uji_popup_code shortcode

Affected Software: Uji Popup
CVE ID: CVE-2023-23641
CVSS Score: 6.4 (Medium)
Researcher/s: Lana Codes
Patch Status: Unpatched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/1e81208c-771f-409e-b665-b07def0ca774

WPJAM Basic <= 6.2.1 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

Affected Software: WPJAM Basic
CVE ID: CVE-2023-23709
CVSS Score: 6.4 (Medium)
Researcher/s: Lana Codes
Patch Status: Patched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/2a5ccc0b-a80a-41df-991c-5c356eb10512

ActiveCampaign – Forms, Site Tracking, Live Chat <= 8.1.11 – Authenticated (Contributor+) Stored Cross-Site Scripting

Affected Software: ActiveCampaign – Forms, Site Tracking, Live Chat
CVE ID: CVE-2023-0233
CVSS Score: 6.4 (Medium)
Researcher/s: Lana Codes
Patch Status: Patched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/47e25cfa-fedf-413a-bfe7-18a1de429bc3

Mail Subscribe List <= 2.1.9 – Authenticated (Contributor+) Stored Cross-Site Scripting via smlsubform shortcode

Affected Software: Mail Subscribe List
CVE ID: CVE-2023-23657
CVSS Score: 6.4 (Medium)
Researcher/s: Lana Codes
Patch Status: Unpatched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/55b39859-b8a0-418b-ae7a-cd42d6e0bf00

BBSpoiler <= 2.01 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

Affected Software: BBSpoiler
CVE ID: CVE-2023-23873
CVSS Score: 6.4 (Medium)
Researcher/s: Lana Codes
Patch Status: Unpatched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/789497b1-36cf-4de2-bca0-52c0c2a08f72

Product Slider For WooCommerce Lite <= 1.1.7 – Authenticated(Contributor+) Stored Cross-Site Scripting via Meta Keys

Affected Software: Product Slider For WooCommerce Lite
CVE ID: CVE-2023-0537
CVSS Score: 6.4 (Medium)
Researcher/s: Lana Codes
Patch Status: Unpatched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/8159ee7c-69ac-4422-ba8b-664f1fee8e07

Wp-D3 <= 2.4.1 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

Affected Software: Wp-D3
CVE ID: CVE-2023-0536
CVSS Score: 6.4 (Medium)
Researcher/s: Lana Codes
Patch Status: Unpatched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/89409461-c87e-4882-bf53-cc789e459b4f

Social Share Boost <= 4.4 – Authenticated (Contributor+) Stored Cross-Site Scripting via ssboost shortcode

Affected Software: Social Share Boost
CVE ID: CVE-2023-23688
CVSS Score: 6.4 (Medium)
Researcher/s: Lana Codes
Patch Status: Unpatched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/9290532f-58d7-4e7d-9fa0-89c7f82b0466

WP Links Page <= 4.9.1 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

Affected Software: WP Links Page
CVE ID: CVE-2023-22720
CVSS Score: 6.4 (Medium)
Researcher/s: Lana Codes
Patch Status: Unpatched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/9ef3297d-8686-44aa-ac73-793b644be3f2

WP-FormAssembly <= 2.0.7 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

Affected Software: WP-FormAssembly
CVE ID: CVE Unknown
CVSS Score: 6.4 (Medium)
Researcher/s: Unknown
Patch Status: Patched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/a3b164e0-de2e-40d5-935e-31f5bebd87cf

Mega Addons For WPBakery Page Builder <= 4.2.7 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

Affected Software: Mega Addons For WPBakery Page Builder
CVE ID: CVE-2023-0268
CVSS Score: 6.4 (Medium)
Researcher/s: Lana Codes
Patch Status: Unpatched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/a443b20e-1686-4519-890d-e6f1838fb05c

WP Popups – WordPress Popup builder <= 2.5.1 – Authenticated (Contributor+) Stored Cross-Site Scripting

Affected Software: WP Popups – WordPress Popup builder
CVE ID: CVE-2023-1905
CVSS Score: 6.4 (Medium)
Researcher/s: Erwan LR
Patch Status: Patched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/a9747cda-735c-4087-8c4d-9c445c6d1596

Ultimate Carousel For Elementor <= 2.1.7 – Authenticated (Contributor+) Stored Cross-Site Scripting

Affected Software: Ultimate Carousel For Elementor
CVE ID: CVE-2023-0280
CVSS Score: 6.4 (Medium)
Researcher/s: Lana Codes
Patch Status: Unpatched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/b0e35280-0c2a-4fe1-bfbe-3321338ff1a5

Custom Post Type List Shortcode <= 1.4.4 – Authenticated (Contributor+) Stored Cross-Site Scripting

Affected Software: Custom Post Type List Shortcode
CVE ID: CVE-2023-0542
CVSS Score: 6.4 (Medium)
Researcher/s: Lana Codes
Patch Status: Unpatched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/b702f507-475a-4d45-8bb1-635f5f377c88

File Gallery <= 1.8.5.3 – Authenticated (Contributor+) Stored Cross-Site Scripting via file_gallery_shortcode

Affected Software: File Gallery
CVE ID: CVE-2023-23676
CVSS Score: 6.4 (Medium)
Researcher/s: Lana Codes
Patch Status: Patched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/c11be4ba-1bed-4234-b475-468394b7be90

Ultimate Carousel For WPBakery Page Builder <= 2.6 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

Affected Software: Ultimate Carousel For WPBakery Page Builder
CVE ID: CVE-2023-0267
CVSS Score: 6.4 (Medium)
Researcher/s: Lana Codes
Patch Status: Unpatched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/c97fc289-1ee3-4401-a57e-b4c8d998259e

FormCraft <= 1.2.6 – Authenticated (Contributor+) Stored Cross-Site Scripting via fcb shortcode

Affected Software: FormCraft – Contact Form Builder for WordPress
CVE ID: CVE-2023-22717
CVSS Score: 6.4 (Medium)
Researcher/s: Lana Codes
Patch Status: Unpatched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/cf17a817-6f61-43d5-9da2-58fbbef458d9

Post Shortcode <= 2.0.9 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

Affected Software: Post Shortcode
CVE ID: CVE-2023-0526
CVSS Score: 6.4 (Medium)
Researcher/s: Lana Codes
Patch Status: Unpatched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/f3e1d66d-34cf-491c-8a07-0f9efd3c9669

Kaya QR Code Generator <= 1.5.2 – Authenticated (Contributor+) Stored Cross-Site Scripting via qrCode attribute

Affected Software: Kaya QR Code Generator
CVE ID: CVE-2023-30784
CVSS Score: 6.4 (Medium)
Researcher/s: Mika
Patch Status: Patched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/f4f0bb58-d904-4bf4-9e15-4ee6289c2df4

vSlider Multi Image Slider <= 4.1.2 – Cross-Site Request Forgery

Affected Software: vSlider Multi Image Slider for WordPress
CVE ID: CVE-2023-22672
CVSS Score: 6.3 (Medium)
Researcher/s: minhtuanact
Patch Status: Unpatched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/14376064-13c4-4874-afea-395af2a1933d

WP Docs <= 1.9.8 – Missing Authorization via multiple AJAX actions

Affected Software: WP Docs
CVE ID: CVE-2023-30873
CVSS Score: 6.3 (Medium)
Researcher/s: Lana Codes
Patch Status: Patched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/45a870f4-7ad1-447b-81ea-5d9e9b67b1bb

Membership Database <= 1.0 – Reflected Cross-Site Scripting

Affected Software: Membership Database
CVE ID: CVE-2023-0514
CVSS Score: 6.1 (Medium)
Researcher/s: Shreya Pohekar
Patch Status: Unpatched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/07ede585-c0d2-4643-9c36-7b5da5f721bd

CMS Tree Page View <= 1.6.7 – Reflected Cross-Site Scripting

Affected Software: CMS Tree Page View
CVE ID: CVE-2023-30868
CVSS Score: 6.1 (Medium)
Researcher/s: LEE SE HYOUNG
Patch Status: Patched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/19796773-3d5f-458d-aab1-743b6835c71b

Church Admin <= 3.7.5 – Reflected Cross-Site Scripting

Affected Software: Church Admin
CVE ID: CVE-2023-30782
CVSS Score: 6.1 (Medium)
Researcher/s: Le Ngoc Anh
Patch Status: Patched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/2204017a-0363-4f2f-909a-e0826463477c

Update Image Tag Alt Attribute <= 2.4.5 – Reflected Cross-Site Scripting

Affected Software: Update Image Tag Alt Attribute
CVE ID: CVE-2023-27455
CVSS Score: 6.1 (Medium)
Researcher/s: Skalucy
Patch Status: Unpatched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/25b13322-d305-45db-8ac7-20762398dc21

Charitable <= 1.7.0.10 – Reflected Cross-Site Scripting

Affected Software: Donation Forms by Charitable – Donations Plugin & Fundraising Platform for WordPress
CVE ID: CVE-2022-47441
CVSS Score: 6.1 (Medium)
Researcher/s: TEAM WEBoB of BoB 11th
Patch Status: Patched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/2b3b9576-7c7d-4665-92d5-03aa292cdbbe

WCP Contact Form <= 3.1.0 – Reflected Cross-Site Scripting via tab parameter

Affected Software: WCP Contact Form
CVE ID: CVE-2023-22703
CVSS Score: 6.1 (Medium)
Researcher/s: Le Ngoc Anh
Patch Status: Unpatched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/33fd4542-0a46-4779-be02-d713dcbc8f96

Google Analytics Top Content Widget <= 1.5.5 – Reflected Cross-Site Scripting

Affected Software: Google Analytics Top Content Widget
CVE ID: CVE-2015-10101
CVSS Score: 6.1 (Medium)
Researcher/s: Unknown
Patch Status: Patched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/4522480a-dfbf-4ff4-93c2-68b8cc15367c

RapidExpCart <= 1.0 – Cross-Site Request Forgery to Stored Cross-Site Scripting

Affected Software: RapidExpCart
CVE ID: CVE-2023-0520
CVSS Score: 6.1 (Medium)
Researcher/s: Shreya Pohekar
Patch Status: Unpatched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/52fde632-f3a4-48d5-8c2c-c42b9d20dcb7

ChatBot <= 4.4.4 – Unauthenticated Stored Cross-Site Scripting via Cross-Site Request Forgery

Affected Software: AI ChatBot
CVE ID: CVE-2023-1011
CVSS Score: 6.1 (Medium)
Researcher/s: Erwan LR
Patch Status: Patched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/56fad8de-6646-4305-83a9-0ed443c3aa7d

WooCommerce Easy Duplicate Product <= 0.3.0.0 – Reflected Cross-Site Scripting via wedp_duplicated

Affected Software: WooCommerce Easy Duplicate Product
CVE ID: CVE-2023-30747
CVSS Score: 6.1 (Medium)
Researcher/s: Nguyen Xuan Chien
Patch Status: Patched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/8b06d68e-153d-4cee-94d5-cbeac7468665

Tablesome <= 1.0.8 – Reflected Cross-Site Scripting

Affected Software: Tablesome – Data table & Workflow Automation ( Contact Form Entries, Email Log, OpenAI / ChatGPT )
CVE ID: CVE Unknown
CVSS Score: 6.1 (Medium)
Researcher/s: Unknown
Patch Status: Patched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/8d769308-6273-4ed2-b64a-d9f065de4cce

YellowPencil Visual CSS Style Editor <= 7.5.8 – Reflected Cross-Site Scripting liveLink

Affected Software: Visual CSS Style Editor
CVE ID: CVE-2022-33961
CVSS Score: 6.1 (Medium)
Researcher/s: Muhammad Daffa
Patch Status: Patched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/967ff273-33f3-4580-928a-7764583429aa

Sloth Logo Customizer <= 2.0.2 – Cross-Site Request Forgery to Stored Cross-Site Scripting

Affected Software: Sloth Logo Customizer
CVE ID: CVE-2023-0603
CVSS Score: 6.1 (Medium)
Researcher/s: Nithissh S
Patch Status: Unpatched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/974f14e8-1a59-4ba5-8806-b4d8b135315e

Modal Dialog <= 3.5.14 – Reflected Cross-Site Scripting

Affected Software: Modal Dialog
CVE ID: CVE-2023-31071
CVSS Score: 6.1 (Medium)
Researcher/s: LEE SE HYOUNG
Patch Status: Patched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/99140d47-88bb-48a1-863a-93a558541800

Thumbnail carousel slider <= 1.1.9 – Reflected Cross-Site Scripting

Affected Software: Thumbnail carousel slider
CVE ID: CVE-2023-1915
CVSS Score: 6.1 (Medium)
Researcher/s: Chien Vuong
Patch Status: Patched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/99711f41-d21b-4725-acc8-9542283daf12

Yml for Yandex Market <= 3.10.7 – Reflected Cross-Site Scripting

Affected Software: YML for Yandex Market
CVE ID: CVE-2023-30473
CVSS Score: 6.1 (Medium)
Researcher/s: LEE SE HYOUNG
Patch Status: Patched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/a823a21e-78b5-4186-bb67-88799509970d

Woocommerce Email Report <= 2.4 – Unauthenticated Cross-Site Scripting

Affected Software: Woocommerce Email Report
CVE ID: CVE-2023-27627
CVSS Score: 6.1 (Medium)
Researcher/s: Yuki Haruma
Patch Status: Unpatched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/abdbee50-b8c3-4254-a828-37629a798c92

Stock Exporter for WooCommerce <= 1.1.0 – Reflected Cross-Site Scripting

Affected Software: Stock Exporter for WooCommerce
CVE ID: CVE-2023-30871
CVSS Score: 6.1 (Medium)
Researcher/s: LEE SE HYOUNG
Patch Status: Patched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/b65184e6-8072-4dd7-8291-c92817e55beb

Query Wrangler <= 1.5.51 – Reflected Cross-Site Scripting via page parameter

Affected Software: Query Wrangler
CVE ID: CVE-2023-30779
CVSS Score: 6.1 (Medium)
Researcher/s: LEE SE HYOUNG
Patch Status: Patched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/c79d781e-4c11-43e9-8c5f-aa89e8fbf635

Video Grid <= 1.21 – Reflected Cross-Site Scripting

Affected Software: Video Grid
CVE ID: CVE-2023-30785
CVSS Score: 6.1 (Medium)
Researcher/s: yuyudhn
Patch Status: Patched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/c92e166d-2ede-4280-a875-d30c0cf6f467

RapidExpCart <= 1.0 – Authenticated (Level 8/Administrator+) Stored Cross-Site Scripting

Video Grid <= 1.21 – Reflected Cross-Site Scripting

Affected Software: Video Grid
CVE ID: CVE Unknown
CVSS Score: 6.1 (Medium)
Researcher/s: Marco Wotschka
Patch Status: Patched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/db5247ad-dbbf-4d8e-92f5-3a673b97d080

Responsive Filterable Portfolio <= 1.0.19 – Reflected Cross-Site Scripting

Affected Software: Responsive Filterable Portfolio
CVE ID: CVE-2023-2119
CVSS Score: 6.1 (Medium)
Researcher/s: Marco Wotschka
Patch Status: Patched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/e67dfe0f-ac1c-4a78-bfc9-0cfd6c3040d4

Japanized For WooCommerce <= 2.5.6 – Reflected Cross-Site Scripting

Affected Software: Japanized For WooCommerce
CVE ID: CVE-2023-0948
CVSS Score: 6.1 (Medium)
Researcher/s: Erwan LR
Patch Status: Unpatched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/ea7d643c-3388-469f-b4a9-5c68341e2af0

PropertyHive <= 1.5.48 – Reflected Cross-Site Scripting via date_post_id

Affected Software: PropertyHive
CVE ID: CVE-2023-22706
CVSS Score: 6.1 (Medium)
Researcher/s: Nguyen Xuan Chien
Patch Status: Unpatched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/ea82e978-a653-4ae3-94aa-bc77b94a176c

Thumbnail carousel slider <= 1.1.9 – Reflected Cross-Site Scripting

Affected Software: Thumbnail carousel slider
CVE ID: CVE-2023-2120
CVSS Score: 6.1 (Medium)
Researcher/s: Marco Wotschka
Patch Status: Patched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/f4bf4e12-5cbb-45bc-938e-62163baaa15d

ARMember <= 4.0 – Reflected Cross-Site Scripting

Affected Software: ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup
CVE ID: CVE-2022-47140
CVSS Score: 6.1 (Medium)
Researcher/s: TEAM WEBoB of BoB 11th
Patch Status: Unpatched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/fd22babc-f1a9-4f50-9756-fe692105dca3

WP Responsive Tabs horizontal vertical and accordion Tabs <= 1.1.15 – Reflected Cross-Site Scripting

Affected Software: WP Responsive Tabs horizontal vertical and accordion Tabs
CVE ID: CVE-2023-2184
CVSS Score: 6.1 (Medium)
Researcher/s: Marco Wotschka
Patch Status: Patched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/fe54c37f-1421-48aa-b502-045847d13ae3

Themify Portfolio Post <= 1.2.2 – Authenticated (Editor+) Stored Cross-Site Scripting

Affected Software: Themify Portfolio Post
CVE ID: CVE-2022-32970
CVSS Score: 5.5 (Medium)
Researcher/s: Muhammad Daffa
Patch Status: Unpatched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/0f3c3629-b7a9-4f83-a821-64119ed662ce

TaxoPress <= 3.6.4 – Authenticated (Editor+) Stored Cross-Site Scripting

Affected Software: TaxoPress is the WordPress Tag, Category, and Taxonomy Manager
CVE ID: CVE-2023-2168
CVSS Score: 5.5 (Medium)
Researcher/s: Ivan Kuzymchak
Patch Status: Patched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/1c051bfd-2754-4faf-8062-91752555166c

TaxoPress <= 3.6.4 – Authenticated (Editor+) Stored Cross-Site Scripting

Affected Software: TaxoPress is the WordPress Tag, Category, and Taxonomy Manager
CVE ID: CVE-2023-2169
CVSS Score: 5.5 (Medium)
Researcher/s: Ivan Kuzymchak
Patch Status: Patched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/52574d99-1ffe-4152-bf13-9cdd11d7300a

YourChannel <= 1.2.5 – Authenticated (Administrator+) Stored Cross-Site Scripting

Affected Software: YourChannel: Everything you want in a YouTube plugin.
CVE ID: CVE-2023-1869
CVSS Score: 5.5 (Medium)
Researcher/s: Marco Wotschka
Patch Status: Patched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/a81d5615-0b96-4d89-a525-7e80a10a9317

TaxoPress <= 3.6.4 – Authenticated (Editor+) Stored Cross-Site Scripting

Affected Software: TaxoPress is the WordPress Tag, Category, and Taxonomy Manager
CVE ID: CVE-2023-2170
CVSS Score: 5.5 (Medium)
Researcher/s: Ivan Kuzymchak
Patch Status: Patched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/e98ed932-4e4c-4127-ae72-500e2a34f371

Motors – Car Dealer & Classified Ads <= 1.4.4 – Cross-Site Request Forgery via Multiple Functions

Affected Software: Motors – Car Dealer, Classifieds & Listing
CVE ID: CVE-2022-38716
CVSS Score: 5.4 (Medium)
Researcher/s: Lana Codes
Patch Status: Unpatched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/0ca9e920-3c7a-4991-8c24-2e55c4f4767c

LearnPress – Export/Import Courses <= 4.0.2 – Reflected Cross-Site Scripting

Affected Software: LearnPress Export Import – WordPress extension for LearnPress
CVE ID: CVE-2023-30487
CVSS Score: 5.4 (Medium)
Researcher/s: LEE SE HYOUNG
Patch Status: Patched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/1322e229-5e0b-4c3d-ae96-e211a2831842

PowerPress <= 10.0.1 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

Affected Software: PowerPress Podcasting plugin by Blubrry
CVE ID: CVE-2023-30778
CVSS Score: 5.4 (Medium)
Researcher/s: Mika
Patch Status: Patched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/1c40c28f-554f-42d0-9f6d-a899d8f61519

Smart WooCommerce Search <= 2.5.0 – Missing Authorization

Affected Software: Smart WooCommerce Search
CVE ID: CVE-2023-30783
CVSS Score: 5.4 (Medium)
Researcher/s: Lana Codes
Patch Status: Unpatched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/59931266-766f-42d2-bcde-04d694a444b0

ShopEngine <= 4.1.1 – Cross-Site Request Forgery

Affected Software: ShopEngine – Elementor WooCommerce Builder Addons, Variation Swatches, Wishlist, Products Compare – All in One Solution
CVE ID: CVE-2022-45371
CVSS Score: 5.4 (Medium)
Researcher/s: Muhammad Daffa
Patch Status: Unpatched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/94abb34a-4451-4f41-ba23-d2a723e5a2e7

Freshdesk (official) <= 1.7 – Open Redirect

Affected Software: Freshdesk (official)
CVE ID: CVE-2015-10102
CVSS Score: 5.4 (Medium)
Researcher/s: Unknown
Patch Status: Patched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/d6f20fc3-41e5-4220-ac8b-54eb11719f07

Locatoraid Store Locator <= 3.9.14 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

Affected Software: Locatoraid Store Locator
CVE ID: CVE-2023-2031
CVSS Score: 5.4 (Medium)
Researcher/s: Alex Thomas
Patch Status: Patched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/dba0a90b-f13c-4914-b6b7-278227ffc122

Active Directory Integration / LDAP Integration <= 4.1.0 – Unauthenticated Information Disclosure

Affected Software: Active Directory Integration / LDAP Integration
CVE ID: CVE-2023-0812
CVSS Score: 5.3 (Medium)
Researcher/s: Lana Codes
Patch Status: Patched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/2568018b-29f3-4261-ae0d-658ca9d96846

CMP – Coming Soon & Maintenance <= 4.1.7 – Maintenance Mode Bypass

Affected Software: CMP – Coming Soon & Maintenance Plugin by NiteoThemes
CVE ID: CVE-2023-2159
CVSS Score: 5.3 (Medium)
Researcher/s: Marco Wotschka
Patch Status: Patched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/af955f69-b18c-446e-b05e-6a57a5f16dfa

Helpie FAQ <= 1.9.6 – Reflected Cross-Site Scripting

Affected Software: Accordion & FAQ – Helpie WordPress Frequently Asked Questions plugin
CVE ID: CVE Unknown
CVSS Score: 4.7 (Medium)
Researcher/s: Unknown
Patch Status: Patched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/f389f4bf-ffff-4862-b4e2-4465ca0556ef

Formilla Live Chat <= 1.3.0 – Authenticated (Administrator+) Cross-Site Scripting via ‘FormillaID’

Affected Software: Live Chat by Formilla – Real-time Chat & Chatbots Plugin
CVE ID: CVE-2023-23727
CVSS Score: 4.4 (Medium)
Researcher/s: yuyudhn
Patch Status: Patched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/044e110d-2435-41b8-8aec-917c329b944c

Dave’s WordPress Live Search <= 4.8.1 – Authenticated (Administrator+) Stored Cross-Site Scripting

Affected Software: Dave’s WordPress Live Search
CVE ID: CVE-2023-30876
CVSS Score: 4.4 (Medium)
Researcher/s: Yuki Haruma
Patch Status: Unpatched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/046ecbe5-4b2f-40d3-8585-4d4230ba33f0

Yatra <= 2.1.13 – Authenticated (Administrator+) Stored Cross-Site Scripting

Affected Software: Best Travel Booking WordPress Plugin, Tour Booking System, Trip Booking WordPress Plugin – Yatra
CVE ID: CVE-2022-47436
CVSS Score: 4.4 (Medium)
Researcher/s: TEAM WEBoB of BoB 11th
Patch Status: Unpatched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/07372843-f7d3-4ae4-96b4-ef3f475504ff

Ebook Store <= 5.775 – Authenticated (Administrator+) Stored Cross-Site Scripting

Affected Software: Ebook Store
CVE ID: CVE-2023-22690
CVSS Score: 4.4 (Medium)
Researcher/s: yuyudhn
Patch Status: Patched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/097f6887-e15f-4e35-ab12-1115630e13cc

WP Original Media Path <= 2.4.0 – Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings

Affected Software: WP Original Media Path
CVE ID: CVE-2023-23674
CVSS Score: 4.4 (Medium)
Researcher/s: Rio Darmawan
Patch Status: Patched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/277eb517-c949-41e9-becf-af056fd32f35

Verified Reviews (Avis Vérifiés) <= 2.3.13 – Authenticated (Administrator+) Stored Cross-Site Scripting

Affected Software: Verified Reviews (Avis Vérifiés)
CVE ID: CVE-2023-23720
CVSS Score: 4.4 (Medium)
Researcher/s: yuyudhn
Patch Status: Unpatched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/3044dbfc-e12d-47e0-a297-67ff0510eded

Login Page Styler <= 6.2 – Authenticated (Administrator+) Stored Cross-Site Scripting

WP Custom Author URL <= 1.0.4 – Authenticated (Administrator+) Stored Cross-Site Scripting

Affected Software: WP Custom Author URL
CVE ID: CVE-2023-1614
CVSS Score: 4.4 (Medium)
Researcher/s: Shreya Pohekar
Patch Status: Patched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/4f3a57ce-eead-4631-93da-ba1a0a33ec2d

Formilla Edge <= 1.0 – Authenticated (Administrator+) Cross-Site Scripting via ‘FormillaPluginID’

Affected Software: Formilla Edge Targeted Messaging Platform for Sales and Marketing
CVE ID: CVE Unknown
CVSS Score: 4.4 (Medium)
Researcher/s: Unknown
Patch Status: Patched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/59f7a1b2-f718-40e7-8030-b9212edf71b7

Captcha Them All <= 1.3.3 – Authenticated (Admin+) Stored Cross-Site Scripting

Affected Software: Captcha Them All
CVE ID: CVE-2023-30786
CVSS Score: 4.4 (Medium)
Researcher/s: Yuki Haruma
Patch Status: Patched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/5e2c83b6-3444-4cd1-82ec-567937c563b9

WP Login Box <= 2.0.2 – Authenticated (Admin+) Stored Cross-Site Scripting

Affected Software: WP Login Box
CVE ID: CVE-2023-0544
CVSS Score: 4.4 (Medium)
Researcher/s: Lana Codes
Patch Status: Unpatched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/66c58d4c-8c36-40af-827d-0e86f2110e3c

Subscribers – Free Web Push Notifications <= 1.5.3 – Authenticated (Administrator+) Stored Cross-Site Scripting

Affected Software: Subscribers – Free Web Push Notifications
CVE ID: CVE-2023-22684
CVSS Score: 4.4 (Medium)
Researcher/s: yuyudhn
Patch Status: Unpatched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/66e78219-b3fd-40e9-a58c-8e27ef3c5e4a

Pretty Url <= 1.5.4 – Authenticated (Admin+) Stored Cross-Site Scripting

Affected Software: Pretty Url
CVE ID: CVE-2023-2009
CVSS Score: 4.4 (Medium)
Researcher/s: Shezad Master
Patch Status: Unpatched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/6f54fb59-03c1-45e9-a498-1fa1409c4466

Flyzoo Chat <= 2.3.3 – Authenticated (Administrator+) Stored Cross-Site Scripting

Affected Software: Flyzoo Chat
CVE ID: CVE-2022-46817
CVSS Score: 4.4 (Medium)
Researcher/s: Justiice
Patch Status: Unpatched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/74ea8f1e-d6ff-4a32-b8bf-5d4c8e69433e

Robokassa payment gateway for Woocommerce <= 1.4.5 – Authenticated (Administrator+) Stored Cross-Site Scripting

Affected Software: Robokassa payment gateway for Woocommerce
CVE ID: CVE Unknown
CVSS Score: 4.4 (Medium)
Researcher/s: Unknown
Patch Status: Patched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/75824b96-8674-4340-9e56-b0cb0f52503d

White Label Branding for Elementor Page Builder <= 1.0.2 – Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings

Affected Software: White Label Branding for Elementor Page Builder
CVE ID: CVE-2023-23683
CVSS Score: 4.4 (Medium)
Researcher/s: Rio Darmawan
Patch Status: Unpatched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/8e187b71-860e-4404-bbe2-193c6ecfd485

Category Specific RSS feed Subscription <= v2.2 – Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings

Affected Software: Category Specific RSS feed Subscription
CVE ID: CVE-2023-22685
CVSS Score: 4.4 (Medium)
Researcher/s: yuyudhn
Patch Status: Patched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/9ac9c146-5065-46fc-b2ae-20b820a8016b

Formilla Chat and Marketing Automation <= 1.0 – Authenticated (Administrator+) Cross-Site Scripting via ‘FormillaToolsID’

Affected Software: Customer Support Software, Live Chat, & Marketing Automation
CVE ID: CVE Unknown
CVSS Score: 4.4 (Medium)
Researcher/s: Unknown
Patch Status: Patched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/a5436d14-cbb5-420f-9f3a-698ce59c1e1e

Semalt Blocker <= 1.1.3 – Authenticated (Administrator+) Stored Cross-Site Scripting

Affected Software: Semalt Blocker
CVE ID: CVE-2023-23794
CVSS Score: 4.4 (Medium)
Researcher/s: Rio Darmawan
Patch Status: Unpatched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/a658d150-bcd5-4334-b07a-e09b3995169d

SparkPost <= 3.2.5 – Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings

Affected Software: SparkPost
CVE ID: CVE-2023-23654
CVSS Score: 4.4 (Medium)
Researcher/s: Rio Darmawan
Patch Status: Unpatched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/ab86ddc9-9b43-4949-b150-7b944bc40558

EZP Maintenance Mode <= 1.0.1 – Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings

Affected Software: EZP Maintenance Mode
CVE ID: CVE-2023-23682
CVSS Score: 4.4 (Medium)
Researcher/s: Rio Darmawan
Patch Status: Unpatched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/ac1239c9-72a6-44d8-911f-70a528c66c62

Redirect After Login <= 0.1.9 – Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings

Affected Software: Redirect After Login
CVE ID: CVE-2023-27624
CVSS Score: 4.4 (Medium)
Researcher/s: Yuki Haruma
Patch Status: Unpatched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/ad1a79f3-274f-4a33-a752-669c09c2d47d

GPS Plotter <= 5.1.4 – Authenticated (Administrator+) Stored Cross-Site Scripting

Affected Software: Gps Plotter
CVE ID: CVE-2023-30874
CVSS Score: 4.4 (Medium)
Researcher/s: Yuki Haruma
Patch Status: Unpatched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/ca449d15-b05e-4341-99b0-472a14cab8f4

WP-dTree <= 4.4.5 – Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings

Affected Software: WP-dTree
CVE ID: CVE-2022-47423
CVSS Score: 4.4 (Medium)
Researcher/s: Justiice
Patch Status: Unpatched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/cde92185-d63a-47b3-a17e-3f2b2b20270c

Panorama – WordPress Project Management Plugin <= 1.5 – Authenticated (Administrator+) Stored Cross-Site Scripting

Affected Software: Panorama – WordPress Project Management Plugin
CVE ID: CVE-2023-23810
CVSS Score: 4.4 (Medium)
Researcher/s: Rio Darmawan
Patch Status: Patched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/d131115b-e2c9-42c6-9262-a19272944652

Continuous announcement scroller <= 13.0 – Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings

Affected Software: Continuous announcement scroller
CVE ID: CVE-2022-46819
CVSS Score: 4.4 (Medium)
Researcher/s: Justiice
Patch Status: Unpatched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/d88eb628-09c9-451c-b5ae-f26a93514447

ApexChat <= 1.3.1 – Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings

Affected Software: ApexChat
CVE ID: CVE-2023-28414
CVSS Score: 4.4 (Medium)
Researcher/s: Yuki Haruma
Patch Status: Unpatched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/dbe8d164-85c7-444d-80ad-4d03151b939b

Simple Tooltips <= 2.1.4 – Authenticated (Administrator+) Stored Cross-Site Scripting

Affected Software: Simple Tooltips
CVE ID: CVE-2023-25958
CVSS Score: 4.4 (Medium)
Researcher/s: deokhunKim
Patch Status: Unpatched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/dc7e4235-5f40-48c2-8474-cf57af5e35bd

Cab Grid <= 1.5.15 – Authenticated (Administrator+) Stored Cross-Site Scripting

Affected Software: Cab Grid
CVE ID: CVE-2023-28533
CVSS Score: 4.4 (Medium)
Researcher/s: Yuki Haruma
Patch Status: Unpatched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/e09c629b-9908-4548-b828-9e6140ff5670

Image Optimizer WD <= 1.0.26 – Authenticated (Administrator+) Stored Cross-Site Scripting

Affected Software: Image Optimizer by 10web – Image Optimizer and Compression plugin
CVE ID: CVE Unknown
CVSS Score: 4.4 (Medium)
Researcher/s: Unknown
Patch Status: Patched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/e5eea72d-f10b-460b-be00-bb5b1c4a1a62

BizLibrary <= 1.1 – Authenticated (Admin+) Stored Cross-Site Scripting

Affected Software: BizLibrary
CVE ID: CVE-2023-0892
CVSS Score: 4.4 (Medium)
Researcher/s: Shreya Pohekar
Patch Status: Unpatched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/ee7513d9-e76c-4da4-919b-ba376f0c4022

Easy Ad Manager <= 1.0.0 – Authenticated (Administrator+) Stored Cross-Site Scripting

Affected Software: Easy Ad Manager
CVE ID: CVE-2023-25460
CVSS Score: 4.4 (Medium)
Researcher/s: Lokesh Dachepalli
Patch Status: Unpatched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/f7750f70-e79c-45fb-b792-ba6a4da59964

eRocket <= 1.2.4 – Authenticated (Administrator+) Stored Cross-Site Scripting

Affected Software: eRocket
CVE ID: CVE-2023-28174
CVSS Score: 4.4 (Medium)
Researcher/s: Yuki Haruma
Patch Status: Unpatched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/fb9b8f3a-6f49-455d-99c6-cdf5671af49d

Ninja Tables <= 4.3.4 – Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings

Affected Software: Ninja Tables – Best Data Table Plugin for WordPress
CVE ID: CVE-2022-47137
CVSS Score: 4.4 (Medium)
Researcher/s: Muhammad Daffa
Patch Status: Patched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/fc296c70-358e-4908-be49-5ffae83aca9b

GDPR Compliance & Cookie Consent <= 1.2 – Cross-Site Request Forgery

Affected Software: GDPR Compliance & Cookie Consent
CVE ID: CVE-2022-45815
CVSS Score: 4.3 (Medium)
Researcher/s: Lana Codes
Patch Status: Unpatched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/052b345a-7b71-4de5-9bf8-8b81cc1b4e77

Image Optimizer by 10web <= 1.0.25 – Directory Traversal to Information Exposure

Affected Software: Image Optimizer by 10web – Image Optimizer and Compression plugin
CVE ID: CVE Unknown
CVSS Score: 4.3 (Medium)
Researcher/s: Unknown
Patch Status: Patched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/0b4a0dff-1054-4f50-8ff5-e3cc2b45d77b

Essential Blocks <= 4.0.6 – Missing Authorization via get

Affected Software: Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates
CVE ID: CVE-2023-2084
CVSS Score: 4.3 (Medium)
Researcher/s: Marco Wotschka
Patch Status: Patched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/0be8c668-0f1c-4f83-8a71-49c8bb9b67ae

Album Gallery – WordPress Gallery <= 1.4.9 – Cross-Site Request Forgery via album-gallery-column-settings.php

Affected Software: Album Gallery – WordPress Gallery
CVE ID: CVE-2023-23646
CVSS Score: 4.3 (Medium)
Researcher/s: Mika
Patch Status: Patched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/0f3df75e-cf2f-4076-b5ff-b8540408044a

Layer Slider <= 1.1.9.6 – Cross-Site Request Forgery via save_slide_ajax

Affected Software: Layer Slider
CVE ID: CVE-2023-23671
CVSS Score: 4.3 (Medium)
Researcher/s: Rafshanzani Suhada
Patch Status: Unpatched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/1ad366f1-2369-4fb2-aeda-301c85cf6801

Enable/Disable Auto Login when Register <= 1.1.0 Cross-Site Request Forgery

Affected Software: Enable/Disable Auto Login when Register
CVE ID: CVE-2023-0522
CVSS Score: 4.3 (Medium)
Researcher/s: Lana Codes
Patch Status: Unpatched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/1fa45fa7-b1da-42f0-945b-2a6b0db5ba91

Zendesk Support for WordPress <= 1.8.4 – Cross-Site Request Forgery

Affected Software: Zendesk Support for WordPress
CVE ID: CVE-2023-23716
CVSS Score: 4.3 (Medium)
Researcher/s: Lana Codes
Patch Status: Unpatched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/212b7da7-bd3e-42df-8b50-a3eb472cf440

LIQUID SPEECH BALLOON <= 1.1.8 – Cross-Site Request Forgery to Settings Update

Affected Software: LIQUID SPEECH BALLOON
CVE ID: CVE-2023-27889
CVSS Score: 4.3 (Medium)
Researcher/s: Ryo Sato
Patch Status: Patched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/23980e13-b632-43ec-938e-8171884cb87b

WP Docs <= 1.9.8 – Cross-Site Request Forgery to folder management

Affected Software: WP Docs
CVE ID: CVE-2023-30873
CVSS Score: 4.3 (Medium)
Researcher/s: Lana Codes
Patch Status: Patched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/6003b1bf-b176-4ca9-9de2-58133259e0f6

Pearl <= 1.3.4 – Cross-Site Request Forgery via stm_hb_save_settings

Affected Software: WordPress Header Builder Plugin – Pearl
CVE ID: CVE-2022-38356
CVSS Score: 4.3 (Medium)
Researcher/s: Lana Codes
Patch Status: Unpatched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/6058da9e-8ca3-4966-bb10-e5da526e8c7e

WooCommerce Order Status Change Notifier <= 1.1.0 – Authenticated (Subscriber+) Arbitrary Order Status Update

Affected Software: WooCommerce Order Status Change Notifier
CVE ID: CVE-2023-2179
CVSS Score: 4.3 (Medium)
Researcher/s: WPScanTeam
Patch Status: Unpatched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/66bc83f5-0f6c-425f-a560-e79e777b76ca

Woocommerce Product Designer <= 4.3.3 – Cross-Site Request Forgery

Affected Software: Woocommerce Products Designer by ORION – online product customizer for t-shirts, print cards, phone cases Lettering & Decals
CVE ID: CVE-2022-46856
CVSS Score: 4.3 (Medium)
Researcher/s: Cat
Patch Status: Unpatched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/70d168a4-a659-4354-889e-7907215351a2

Kodex Posts likes <= 2.4.3 – Cross-Site Request Forgery

Affected Software: Kodex Posts likes
CVE ID: CVE-2022-46814
CVSS Score: 4.3 (Medium)
Researcher/s: minhtuanact
Patch Status: Unpatched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/77d56f61-7e45-405e-878d-fa3d53acede0

Reservation.Studio widget <= 1.0.9 – Cross-Site Request Forgery via plugin settings

Affected Software: Reservation.Studio widget
CVE ID: CVE-2023-25468
CVSS Score: 4.3 (Medium)
Researcher/s: Lokesh Dachepalli
Patch Status: Unpatched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/783e5794-0d74-4b7a-a1cd-2b834a50c50c

BadgeOS <= 3.7.1.6 – Cross-Site Request Forgery

Affected Software: BadgeOS
CVE ID: CVE-2022-41987
CVSS Score: 4.3 (Medium)
Researcher/s: Lana Codes
Patch Status: Unpatched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/7bb1be6d-5af9-4b58-a641-05a913548fe7

Essential Blocks <= 4.0.6 – Missing Authorization via template_count

Affected Software: Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates
CVE ID: CVE-2023-2086
CVSS Score: 4.3 (Medium)
Researcher/s: Marco Wotschka
Patch Status: Patched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/9efc782a-ec61-4741-81fd-a263a2739e16

Gallery Metabox <= 1.5 – Cross-Site Request Forgery via gallery_remove

Affected Software: Gallery Metabox
CVE ID: CVE-2022-47134
CVSS Score: 4.3 (Medium)
Researcher/s: Cat
Patch Status: Unpatched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/9f8b1103-71b2-421e-bcbe-f2716b59e367

Essential Blocks <= 4.0.6 – Missing Authorization via templates

Affected Software: Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates
CVE ID: CVE-2023-2085
CVSS Score: 4.3 (Medium)
Researcher/s: Marco Wotschka
Patch Status: Patched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/ad2c1ab6-5c78-4317-b5e7-c86e2eebeb4f

SiteAlert (Formerly WP Health) <= 1.9.7 – Cross-Site Request Forgery

Affected Software: SiteAlert – Uptime, Speed, and Security Monitoring for WordPress
CVE ID: CVE-2022-46857
CVSS Score: 4.3 (Medium)
Researcher/s: Cat
Patch Status: Unpatched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/c1870c6e-23b6-4f3b-adba-72633d62dfd0

OoohBoi Steroids for Elementor <= 2.1.4 – Missing Authorization leading to Authenticated (Subscriber+) Image Upload

Affected Software: OoohBoi Steroids for Elementor
CVE ID: CVE-2023-1169
CVSS Score: 4.3 (Medium)
Researcher/s: Ramuel Gall
Patch Status: Patched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/c56ed896-9267-49e6-a207-fe5362fe18cd

Clock In Portal <= 2.1 – Cross-Site Request Forgery To Designation Deletion

Affected Software: Clock In Portal- Staff & Attendance Management
CVE ID: CVE-2023-0762
CVSS Score: 4.3 (Medium)
Researcher/s: Sajjad Shariati
Patch Status: Unpatched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/c6b17e90-42df-47ed-9e92-f5f1b990f921

Form Block <= 1.0.1 – Cross-Site Request Forgery

Affected Software: Form Block
CVE ID: CVE Unknown
CVSS Score: 4.3 (Medium)
Researcher/s: Daniel Ruf
Patch Status: Patched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/cb18d6d8-28e5-4125-9209-a71403f678f0

Clock In Portal <= 2.1 – Cross-Site Request Forgery to Designation Deletion

Essential Blocks <= 4.0.6 – Cross-Site Request Forgery via save

Affected Software: Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates
CVE ID: CVE-2023-2087
CVSS Score: 4.3 (Medium)
Researcher/s: Marco Wotschka
Patch Status: Patched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/d38d41c7-8786-4145-9591-3e24eff3b79c

Clock In Portal <= 2.1 – Cross-Site Request Forgery to Staff Deletion

Clock In Portal <= 2.1 – Cross-Site Request Forgery To Holiday Deletion

Simple Share Buttons Adder <= 8.4.6 – Cross-Site Request Forgery

Affected Software: Simple Share Buttons Adder
CVE ID: CVE-2022-47178
CVSS Score: 4.3 (Medium)
Researcher/s: Muhammad Daffa
Patch Status: Patched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/e57bfae5-4cc0-4d97-9431-4c8ebb2f0882

Stream <= 3.9.2 – Cross-Site Request Forgery

Affected Software: Stream
CVE ID: CVE-2022-43490
CVSS Score: 4.3 (Medium)
Researcher/s: Lucio Sá
Patch Status: Patched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/e7203b5c-5753-453c-8fc2-26fcebdeea5b

Essential Blocks <= 4.0.6 – Missing Authorization via save

Affected Software: Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates
CVE ID: CVE-2023-2083
CVSS Score: 4.3 (Medium)
Researcher/s: Marco Wotschka
Patch Status: Patched
Vulnerability Details: https://wordfence.com/threat-intel/vulnerabilities/id/f8bf0933-1c97-4374-b323-c55b91fe4d27

As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.

This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us using our CVE Request form, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

The post Wordfence Intelligence Weekly WordPress Vulnerability Report (Apr 17, 2023 to Apr 23, 2023) appeared first on Wordfence.

Cookie	Duration	Description
_GRECAPTCHA	5 months 27 days	This cookie is set by the Google recaptcha service to identify bots to protect the website against malicious spam attacks.
cookielawinfo-checbox-analytics	11 months	This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Analytics".
cookielawinfo-checbox-functional	11 months	The cookie is set by GDPR cookie consent to record the user consent for the cookies in the category "Functional".
cookielawinfo-checbox-others	11 months	This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Other.
cookielawinfo-checkbox-advertisement	1 year	Set by the GDPR Cookie Consent plugin, this cookie is used to record the user consent for the cookies in the "Advertisement" category .
cookielawinfo-checkbox-necessary	11 months	This cookie is set by GDPR Cookie Consent plugin. The cookies is used to store the user consent for the cookies in the category "Necessary".
cookielawinfo-checkbox-performance	11 months	This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Performance".
viewed_cookie_policy	11 months	The cookie is set by the GDPR Cookie Consent plugin and is used to store whether or not user has consented to the use of cookies. It does not store any personal data.