CVE-2023-27614

WordPress Motor Racing League Plugin <= 1.9.9 is vulnerable to Cross Site Scripting (XSS)

Auth. (admin+) Cross-Site Scripting (XSS) vulnerability in Ian Haycox Motor Racing League plugin <= 1.9.9 versions.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Motor Racing League Project

Products

Motor Racing League

CVE-2023-27358

NETGEAR RAX30 SOAP Request SQL Injection Remote Code Execution Vulnerability

NETGEAR RAX30 SOAP Request SQL Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR RAX30 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of specific SOAP requests. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the service account. Was ZDI-CAN-19754.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Netgear

Products

Rax30 Rax30 Firmware Rax35 and 7 more

CVE-2022-45074

WordPress Activity Reactions For Buddypress Plugin <= 1.0.22 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery (CSRF) vulnerability in Paramveer Singh for Arete IT Private Limited Activity Reactions For Buddypress plugin <= 1.0.22 versions.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Areteit

Products

Activity Reactions For Buddypress

CVE-2022-45080

WordPress Add Multiple Marker Plugin <= 1.2 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery (CSRF) vulnerability in KrishaWeb Add Multiple Marker plugin <= 1.2 versions.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Krishaweb

Products

Add Multiple Marker

CVE-2023-23879

WordPress PHP Execution Plugin <= 1.0.0 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery (CSRF) vulnerability in Nicolas Zeh PHP Execution plugin <= 1.0.0 versions.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Php Execution Project

Products

Php Execution

CVE-2023-22686

WordPress Nice PayPal Button Lite Plugin <= 1.3.5 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery (CSRF) vulnerability in TriniTronic Nice PayPal Button Lite plugin <= 1.3.5 versions.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Trinitronic

Products

Nice Paypal Button Lite

CVE-2023-23892

WordPress M Chart Plugin <= 1.9.4 is vulnerable to Cross Site Scripting (XSS)

Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Jamie Poitra M Chart plugin <= 1.9.4 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

M Chart Project

Products

M Chart

CVE-2022-47158

WordPress alfred24 Click & Collect Plugin <= 1.1.7 is vulnerable to Cross Site Scripting (XSS)

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Pakpobox alfred24 Click & Collect plugin <= 1.1.7 versions.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Alfred24 Click \& Collect Project

Products

Alfred24 Click \& Collect

CVE-2022-47598

WordPress WP Super Popup Plugin <= 1.1.2 is vulnerable to Cross Site Scripting (XSS)

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WP Plugins Pro WP Super Popup plugin <= 1.1.2 versions.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Wp Super Popup Project

Products

Wp Super Popup

CVE-2022-41612

WordPress Similar Posts Plugin <= 3.1.6 is vulnerable to Cross Site Scripting (XSS)

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Shareaholic Similar Posts plugin <= 3.1.6 versions.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Shareaholic

Products

Similar Posts

CVE-2022-45837

WordPress 微信机器人高级版 Plugin <= 6.0.1 is vulnerable to Cross Site Scripting (XSS)

Reflected Cross-Site Scripting (XSS) vulnerability in Denis 微信机器人高级版 plugin <= 6.0.1 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Wpjam

Products

Wechat Robot

CVE-2023-25710

WordPress Click to Call or Chat Buttons Plugin <= 1.4.0 is vulnerable to Cross Site Scripting (XSS)

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in DIGITALBLUE Click to Call or Chat Buttons plugin <= 1.4.0 versions.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Digitalblue

Products

Click To Call Or Chat Buttons

CVE-2023-27619

WordPress Regina Lite Theme <= 2.0.7 is vulnerable to Cross Site Scripting (XSS)

Auth (subscriber+) Reflected Cross-Site Scripting (XSS) vulnerability in Macho Themes Regina Lite theme <= 2.0.7 versions.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Machothemes

Products

Regina Lite

CVE-2023-25490

WordPress Archivist – Custom Archive Templates Plugin <= 1.7.4 is vulnerable to Cross Site Scripting (XSS)

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Eric Teubert Archivist – Custom Archive Templates plugin <= 1.7.4 versions.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Archivist - Custom Archive Templates Project

Products

Archivist - Custom Archive Templates

CVE-2023-25479

WordPress Podlove Subscribe button Plugin <= 1.3.7 is vulnerable to Cross Site Scripting (XSS)

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Podlove Podlove Subscribe button plugin <= 1.3.7 versions.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Podlove

Products

Podlove Subscribe Button

CVE-2023-25484

WordPress Simple Yearly Archive Plugin <= 2.1.8 is vulnerable to Cross Site Scripting (XSS)

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Oliver Schlöbe Simple Yearly Archive plugin <= 2.1.8 versions.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Simple Yearly Archive Project

Products

Simple Yearly Archive

CVE-2022-47608

WordPress Quick Contact Form Plugin <= 8.0.3.1 is vulnerable to Cross Site Scripting (XSS)

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Fullworks Quick Contact Form plugin <= 8.0.3.1 versions.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Fullworksplugins

Products

Quick Contact Form

CVE-2023-25485

WordPress JSON Content Importer Plugin <= 1.3.15 is vulnerable to Cross Site Scripting (XSS)

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Bernhard Kux JSON Content Importer plugin <= 1.3.15 versions.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Json-content-importer

Products

Json Content Importer

CVE-2023-25793

WordPress Link Juice Keeper Plugin <= 2.0.2 is vulnerable to Cross Site Scripting (XSS)

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in George Pattihis Link Juice Keeper plugin <= 2.0.2 versions.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Link Juice Keeper Project

Products

Link Juice Keeper

CVE-2023-25461

WordPress Wp-Insert Plugin <= 2.5.0 is vulnerable to Cross Site Scripting (XSS)

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in namithjawahar Wp-Insert plugin <= 2.5.0 versions.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Smartlogix

Products

Wp-insert