CVE-2023-37890

WordPress KB Support Plugin <= 1.5.88 is vulnerable to Broken Access Control

Missing Authorization vulnerability in WPOmnia KB Support – WordPress Help Desk and Knowledge Base allows Accessing Functionality Not Properly Constrained by ACLs. Users with a role as low as a subscriber can view other customers.This issue affects KB Support – WordPress Help Desk and Knowledge Base: from n/a through 1.5.88.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Logon

Products

Kb Support

CVE-2023-37871

WordPress WooCommerce GoCardless Gateway Plugin <= 2.5.6 is vulnerable to Insecure Direct Object References (IDOR)

Authorization Bypass Through User-Controlled Key vulnerability in WooCommerce GoCardless.This issue affects GoCardless: from n/a through 2.5.6.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Automattic

Products

Woocommerce Gocardless

CVE-2023-37870

WordPress WooCommerce Warranty Requests plugin <= 2.1.9 - Broken Access Control vulnerability

Missing Authorization vulnerability in Woo WooCommerce Warranty Requests.This issue affects WooCommerce Warranty Requests: from n/a through 2.1.9.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Woo

Products

Woocommerce Warranty Requests

CVE-2023-37867

WordPress Yet Another Stars Rating Plugin <= 3.3.8 is vulnerable to Race Condition

Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in YetAnotherStarsRating.Com YASR – Yet Another Star Rating Plugin for WordPress.This issue affects YASR – Yet Another Star Rating Plugin for WordPress: from n/a through 3.3.8.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed

Vendors

Yet Another Stars Rating Project

Products

Yet Another Stars Rating

CVE-2023-37868

WordPress Premium Addons PRO Plugin <= 2.9.0 is vulnerable to Sensitive Data Exposure

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Leap13 Premium Addons PRO.This issue affects Premium Addons PRO: from n/a through 2.9.0.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Leap13

Products

Premium Addons

CVE-2023-36695

WordPress Sublanguage plugin <= 2.9 - Broken Access Control vulnerability

Missing Authorization vulnerability in Maxime Schoeni Sublanguage.This issue affects Sublanguage: from n/a through 2.9.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Maximeschoeni

Products

Sublanguage

CVE-2023-37390

WordPress Themesflat Addons For Elementor Plugin <= 2.0.0 is vulnerable to PHP Object Injection

Deserialization of Untrusted Data vulnerability in Themesflat Themesflat Addons For Elementor.This issue affects Themesflat Addons For Elementor: from n/a through 2.0.0.

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Themesflat

Products

Themesflat Addons For Elementor

CVE-2023-36684

WordPress Convert Pro plugin <= 1.7.5 - Broken Access Control vulnerability

Missing Authorization vulnerability in Brainstorm Force Convert Pro.This issue affects Convert Pro: from n/a through 1.7.5.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Brainstormforce

Products

Convert Pro

CVE-2023-36682

WordPress Schema Pro Plugin <= 2.7.7 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery (CSRF) vulnerability in Brainstorm Force US LLC Schema Pro allows Cross Site Request Forgery.This issue affects Schema Pro: from n/a through 2.7.7.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Brainstormforce

Products

Schema

CVE-2023-36685

WordPress CartFlows Pro Plugin <= 1.11.12 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery (CSRF) vulnerability in Brainstorm Force US LLC CartFlows Pro allows Cross Site Request Forgery.This issue affects CartFlows Pro: from n/a through 1.11.12.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Brainstormforce

Products

Cartflows

CVE-2023-36679

WordPress Spectra plugin <= 2.6.6 - Server Side Request Forgery (SSRF) vulnerability

Server-Side Request Forgery (SSRF) vulnerability in Brainstorm Force Spectra.This issue affects Spectra: from n/a through 2.6.6.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Brainstormforce

Products

Spectra

CVE-2023-36523

WordPress Email download link Plugin <= 3.7 is vulnerable to Sensitive Data Exposure

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Gopi Ramasamy Email download link.This issue affects Email download link: from n/a through 3.7.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Gopiplus

Products

Email Download Link

CVE-2023-36520

WordPress Editorial Calendar Plugin <= 3.7.12 is vulnerable to Insecure Direct Object References (IDOR)

Authorization Bypass Through User-Controlled Key vulnerability in MarketingFire Editorial Calendar.This issue affects Editorial Calendar: from n/a through 3.7.12.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Zackgrossbart

Products

Editorial Calendar

CVE-2023-35916

WordPress WooCommerce Payments Plugin <= 5.9.0 is vulnerable to Insecure Direct Object References (IDOR)

Authorization Bypass Through User-Controlled Key vulnerability in Automattic WooPayments – Fully Integrated Solution Built and Supported by Woo.This issue affects WooPayments – Fully Integrated Solution Built and Supported by Woo: from n/a through 5.9.0.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Automattic

Products

Woopayments

CVE-2023-35915

WordPress WooCommerce Payments Plugin <= 5.9.0 is vulnerable to SQL Injection

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Automattic WooPayments – Fully Integrated Solution Built and Supported by Woo.This issue affects WooPayments – Fully Integrated Solution Built and Supported by Woo: from n/a through 5.9.0.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed

Vendors

Automattic

Products

Woopayments

CVE-2023-36507

WordPress BookingPress Plugin <= 1.0.64 is vulnerable to Sensitive Data Exposure

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Repute Infosystems BookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin.This issue affects BookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin: from n/a through 1.0.64.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Reputeinfosystems

Products

Bookingpress

CVE-2023-35914

WordPress WooCommerce Subscriptions Plugin <= 5.1.2 is vulnerable to Insecure Direct Object References (IDOR)

Authorization Bypass Through User-Controlled Key vulnerability in WooCommerce Woo Subscriptions.This issue affects Woo Subscriptions: from n/a through 5.1.2.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Automattic

Products

Woocommerce Subscriptions

CVE-2023-36505

WordPress Ninja Forms Plugin <= 3.6.24 is vulnerable to Arbitrary File Deletion

Improper Input Validation vulnerability in Saturday Drive Ninja Forms Contact Form.This issue affects Ninja Forms Contact Form : from n/a through 3.6.24.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Ninjaforms

Products

Ninja Forms

CVE-2023-36381

WordPress Zippy Plugin <= 1.6.5 is vulnerable to PHP Object Injection

Deserialization of Untrusted Data vulnerability in Gesundheit Bewegt GmbH Zippy.This issue affects Zippy: from n/a through 1.6.5.

CVSS 3.1 · 6.6 Medium EPSS < 1% KEV · Not listed

Vendors

Gesundheit-bewegt

Products

Zippy

CVE-2023-35883

WordPress Core Web Vitals & PageSpeed Booster Plugin <= 1.0.12 is vulnerable to Open Redirection

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Magazine3 Core Web Vitals & PageSpeed Booster.This issue affects Core Web Vitals & PageSpeed Booster: from n/a through 1.0.12.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Magazine3

Products

Core Web Vitals \& Pagespeed Booster