CVE-2023-46089

WordPress Userback Plugin <= 1.0.13 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery (CSRF) vulnerability in Lee Le @ Userback Userback plugin <= 1.0.13 versions.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Userback

Products

Userback

CVE-2023-46146

WordPress Themify Ultra theme <= 7.3.5 - Multiple Broken Access Control vulnerability

Missing Authorization vulnerability in Themify Themify Ultra.This issue affects Themify Ultra: from n/a through 7.3.5.

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Themify

Products

Ultra

CVE-2023-46087

WordPress Who Hit The Page – Hit Counter Plugin <= 1.4.14.3 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery (CSRF) vulnerability in Mahlamusa Who Hit The Page – Hit Counter plugin <= 1.4.14.3 versions.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Mahlamusa

Products

Who Hit The Page Hit Counter

CVE-2023-46081

WordPress Lava Directory Manager Plugin <= 1.1.34 is vulnerable to Cross Site Scripting (XSS)

Unauth. Stored Cross-Site Scripting (XSS) vulnerability in Lavacode Lava Directory Manager plugin <= 1.1.34 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Lava-code

Products

Lava Directory Manager

CVE-2023-46085

WordPress Wp Ultimate Review Plugin <= 2.2.4 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery (CSRF) vulnerability in Wpmet Wp Ultimate Review plugin <= 2.2.4 versions.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wpmet

Products

Wp Ultimate Review

CVE-2023-46077

WordPress The Awesome Feed – Custom Feed Plugin <= 2.2.5 is vulnerable to Cross Site Scripting (XSS)

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Arrow Plugins The Awesome Feed – Custom Feed plugin <= 2.2.5 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Arrowplugins

Products

The Awesome Feed

CVE-2023-46086

WordPress affiliate-toolkit – WordPress Affiliate Plugin Plugin <= 3.4.3 is vulnerable to Cross Site Scripting (XSS)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SERVIT Software Solutions affiliate-toolkit – WordPress Affiliate Plugin allows Reflected XSS.This issue affects affiliate-toolkit – WordPress Affiliate Plugin: from n/a through 3.4.3.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Servit

Products

Affiliate-toolkit

CVE-2023-46078

WordPress Serial Numbers for WooCommerce – License Manager Plugin <= 1.6.3 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery (CSRF) vulnerability in PluginEver WC Serial Numbers plugin <= 1.6.3 versions.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Pluginever

Products

Wc Serial Numbers

CVE-2023-46076

WordPress WooCommerce PDF Invoice Builder Plugin <= 1.2.102 is vulnerable to Cross Site Scripting (XSS)

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in RedNao WooCommerce PDF Invoice Builder, Create invoices, packing slips and more plugin <= 1.2.102 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Rednao

Products

Woocommerce Pdf Invoice Builder

CVE-2023-46069

WordPress Ajax Archive Calendar Plugin <= 2.6.7 is vulnerable to Cross Site Scripting (XSS)

Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Osmansorkar Ajax Archive Calendar plugin <= 2.6.7 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Osmansorkar

Products

Ajax Archive Calendar

CVE-2023-46070

WordPress EG-Attachments Plugin <= 2.1.3 is vulnerable to Cross Site Scripting (XSS)

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Emmanuel GEORJON EG-Attachments plugin <= 2.1.3 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Egeorjon

Products

Eg-attachments

CVE-2023-46075

WordPress Contact Form Builder, Contact Widget Plugin <= 2.1.6 is vulnerable to Cross Site Scripting (XSS)

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in wpdevart Contact Form Builder, Contact Widget plugin <= 2.1.6 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Wpdevart

Products

Contact Form Builder

CVE-2023-46072

WordPress Add Shortcodes Actions And Filters Plugin <= 2.0.9 is vulnerable to Cross Site Scripting (XSS)

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Michael Simpson Add Shortcodes Actions And Filters plugin <= 2.0.9 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Add Shortcodes Actions And Filters Project

Products

Add Shortcodes Actions And Filters

CVE-2023-46066

WordPress Mediabay Plugin <= 1.6 is vulnerable to Cross Site Scripting (XSS)

Auth. (editor+) Stored Cross-Site Scripting (XSS) vulnerability in Codedrafty Mediabay – Media Library Folders plugin <= 1.6 versions.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Codedraft

Products

Mediabay - Wordpress Media Library Folders

CVE-2023-46071

WordPress Protección de Datos RGPD Plugin <= 3.1.0 is vulnerable to Cross Site Scripting (XSS)

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in ClickDatos Protección de Datos RGPD plugin <= 3.1.0 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Clickdatos

Products

Proteccion De Datos Rgpd

CVE-2023-46067

WordPress Rocket Font Plugin <= 1.2.3 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery (CSRF) vulnerability in Qwerty23 Rocket Font plugin <= 1.2.3 versions.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Qwerty23

Products

Rocket Font

CVE-2023-45836

WordPress Ultimate Taxonomy Manager Plugin <= 2.0 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery (CSRF) vulnerability in XYDAC Ultimate Taxonomy Manager plugin <= 2.0 versions.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Xydac

Products

Ultimate Taxonomy Manager

CVE-2023-45837

WordPress Ultimate Taxonomy Manager Plugin <= 2.0 is vulnerable to Cross Site Scripting (XSS)

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in XYDAC Ultimate Taxonomy Manager plugin <= 2.0 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Xydac

Products

Ultimate Taxonomy Manager

CVE-2023-45767

WordPress Simple Tweet Plugin <= 1.4.0.2 is vulnerable to Cross Site Scripting (XSS)

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Wokamoto Simple Tweet plugin <= 1.4.0.2 versions.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Wokamoto

Products

Simple Tweet

CVE-2023-45762

WordPress Responsive Column Widgets Plugin <= 1.2.7 is vulnerable to Open Redirection

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Michael Uno (miunosoft) Responsive Column Widgets.This issue affects Responsive Column Widgets: from n/a through 1.2.7.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Michaeluno

Products

Responsive Column Widgets