CVE-2023-39163

WordPress Phlox Shop plugin <= 2.0.0 - Unauthenticated Local File Inclusion vulnerability

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Averta Phlox Shop allows PHP Local File Inclusion.This issue affects Phlox Shop: from n/a through 2.0.0.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Averta

Products

Phlox Shop

CVE-2023-39311

WordPress Avada Builder plugin <= 3.11.1 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in ThemeFusion Fusion Builder.This issue affects Fusion Builder: from n/a through 3.11.1.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Avada

Products

Fusion Builder

CVE-2023-39166

WordPress tagDiv Composer Plugin < 4.4 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery (CSRF) vulnerability in tagDiv tagDiv Composer allows Cross-Site Scripting (XSS).This issue affects tagDiv Composer: from n/a before 4.4.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Tagdiv

Products

Tagdiv Composer

CVE-2023-39306

WordPress Avada Builder plugin <= 3.11.1 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeFusion Fusion Builder allows Reflected XSS.This issue affects Fusion Builder: from n/a through 3.11.1.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Wordpress

Products

Wordpress

CVE-2023-39310

WordPress Avada Builder plugin <= 3.11.1 - Authenticated Broken Access Control vulnerability

Missing Authorization vulnerability in ThemeFusion Fusion Builder.This issue affects Fusion Builder: from n/a through 3.11.1.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress

Products

Wordpress

CVE-2023-39307

WordPress Avada theme <= 7.11.1 - Authenticated Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in ThemeFusion Avada.This issue affects Avada: from n/a through 7.11.1.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Theme-fusion

Products

Avada

CVE-2023-39157

WordPress JetElements For Elementor Plugin <= 2.6.10 is vulnerable to Remote Code Execution (RCE)

Improper Control of Generation of Code ('Code Injection') vulnerability in Crocoblock JetElements For Elementor.This issue affects JetElements For Elementor: from n/a through 2.6.10.

CVSS 3.1 · 9 Critical EPSS < 1% KEV · Not listed

Vendors

Crocoblock

Products

Jetelements

CVE-2023-38519

WordPress MainWP Plugin <= 4.4.3.3 is vulnerable to SQL Injection

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in MainWP MainWP Dashboard – WordPress Manager for Multiple Websites Maintenance.This issue affects MainWP Dashboard – WordPress Manager for Multiple Websites Maintenance: from n/a through 4.4.3.3.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed

Vendors

Mainwp

Products

Mainwp Dashboard

CVE-2023-38515

WordPress Church Admin Plugin <= 3.7.56 is vulnerable to Server Side Request Forgery (SSRF)

Server-Side Request Forgery (SSRF) vulnerability in Andy Moyle Church Admin.This issue affects Church Admin: from n/a through 3.7.56.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Church Admin Project

Products

Church Admin

CVE-2023-38513

WordPress Photo Engine Plugin <= 6.2.5 is vulnerable to Insecure Direct Object References (IDOR)

Authorization Bypass Through User-Controlled Key vulnerability in Jordy Meow Photo Engine (Media Organizer & Lightroom).This issue affects Photo Engine (Media Organizer & Lightroom): from n/a through 6.2.5.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Meowapps

Products

Photo Engine

CVE-2023-38481

WordPress Integration for WooCommerce and Zoho CRM Plugin < 1.3.7 is vulnerable to Open Redirection

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks Integration for WooCommerce and Zoho CRM, Books, Invoice, Inventory, Bigin.This issue affects Integration for WooCommerce and Zoho CRM, Books, Invoice, Inventory, Bigin: from n/a before 1.3.7.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Crmperks

Products

Integration For Woocommerce And Zoho Crm\, Books\, Invoice\, Inventory\, Bigin

CVE-2023-38478

WordPress Integration for WooCommerce and QuickBooks Plugin <= 1.2.3 is vulnerable to Open Redirection

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks Integration for WooCommerce and QuickBooks.This issue affects Integration for WooCommerce and QuickBooks: from n/a through 1.2.3.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Crmperks

Products

Integration For Woocommerce And Quickbooks

CVE-2023-38474

WordPress Campaign Monitor for WordPress Plugin <= 2.8.12 is vulnerable to Cross Site Scripting (XSS)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Campaign Monitor Campaign Monitor for WordPress allows Reflected XSS.This issue affects Campaign Monitor for WordPress: from n/a through 2.8.12.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Campaignmonitor

Products

Campaign Monitor

CVE-2023-38400

WordPress Enfold Theme <= 5.6.4 is vulnerable to Cross Site Scripting (XSS)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kriesi Enfold - Responsive Multi-Purpose Theme allows Reflected XSS.This issue affects Enfold - Responsive Multi-Purpose Theme: from n/a through 5.6.4.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Kriesi

Products

Enfold

CVE-2023-38389

WordPress Jupiter X Core plugin <= 3.3.8 - Unauthenticated Account Takeover vulnerability

Incorrect Authorization vulnerability in Artbees JupiterX Core allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects JupiterX Core: from n/a through 3.3.8.

CVSS 3.1 · 9.8 Critical EPSS 1.4% KEV · Not listed

Vendors

Artbees

Products

Jupiter X Core

CVE-2023-38393

WordPress Ninja Forms plugin <= 3.6.25 - Subscriber+ Broken Access Control vulnerability

Missing Authorization vulnerability in Saturday Drive Ninja Forms.This issue affects Ninja Forms: from n/a through 3.6.25.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed

Vendors

Ninjaforma Ninjaforms

Products

Ninja Forms Ninja Forms

CVE-2023-37998

WordPress Disabler Plugin <= 3.0.3 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery (CSRF) vulnerability in Saas Disabler allows Cross Site Request Forgery.This issue affects Disabler: from n/a through 3.0.3.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Saas

Products

Disabler

CVE-2023-37982

WordPress Integration for Contact Form 7 and Salesforce Plugin <= 1.3.3 is vulnerable to Open Redirection

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks Integration for Salesforce and Contact Form 7, WPForms, Elementor, Ninja Forms.This issue affects Integration for Salesforce and Contact Form 7, WPForms, Elementor, Ninja Forms: from n/a through 1.3.3.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Crmperks

Products

Integration For Salesforce And Contact Form 7\, Wpforms\, Elementor\, Ninja Forms

CVE-2023-37978

WordPress HTTP Headers Plugin <= 1.18.11 is vulnerable to Server Side Request Forgery (SSRF)

Server-Side Request Forgery (SSRF) vulnerability in Dimitar Ivanov HTTP Headers.This issue affects HTTP Headers: from n/a through 1.18.11.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed

Vendors

Riverside

Products

Http Headers

CVE-2023-37972

WordPress WooCommerce Product Stock Alert Plugin <= 2.0.1 is vulnerable to Sensitive Data Exposure

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in MultiVendorX Product Stock Manager & Notifier for WooCommerce.This issue affects Product Stock Manager & Notifier for WooCommerce: from n/a through 2.0.1.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Multivendorx

Products

Product Stock Manager \& Notifier For Woocommerce