Medium
CVE-2023-39995
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,587
High
CVE-2023-4293
Premium Packages - Sell Digital Products Securely <= 5.7.4 - Arbitrary User Meta Update to Authenticated (Subscriber+) Privilege Escalation
Medium
CVE-2023-49765
Rate my Post - WP Rating System <= 3.4.1 - Insecure Direct Object Reference
Medium
CVE-2023-30494
ImageRecycle pdf & image compression <= 3.1.10 - Reflected Cross-Site Scripting
Medium
CVE-2023-39996
Accordion and Accordion Slider <= 1.2.4 - Missing Authorization via 'wp_aas_get_attachment_edit_form' and 'wp_aas_save_attachment_data'
High
CVE-2023-3677
WooCommerce PDF Invoice Builder <= 1.2.89 - Authenticated (Subscriber+) SQL Injection via Export
Medium
CVE-2023-40198
Easy Cookie Law <= 3.1 - Cross-Site Request Forgery via 'ecl_options'
Medium
CVE-2023-40206
WP 404 Auto Redirect to Similar Post <= 1.0.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
Medium
CVE-2023-40196
ImageRecycle pdf & image compression <= 3.1.11 - Reflected Cross-Site Scripting
Medium
CVE-2023-40203
MailChimp Forms by MailMunch <= 3.1.4 - Missing Authorization via multiple AJAX actions
Medium
CVE-2023-39997
Popup by Supsystic <= 1.10.19 - Cross-Site Request Forgery
Medium
CVE-2023-40009
WP Pipes <= 1.4.0 - Cross-Site Request Forgery to Settings Update
Medium
CVE-2023-40208
Stock Ticker <= 3.23.3 - Reflected Cross-Site Scripting in ajax_stockticker_load
Low
ghsa-6r78-m64m-qwcf
Moq v4.20.0-rc to 4.20.1 share hashed user data
High
CVE-2023-35881
WooCommerce One Page Checkout <= 2.3.0 - Authenticated (Contributor+) Local File Inclusion via `woocommerce_one_page_checkout`
Medium
CVE-2023-4284
Post Timeline <= 2.2.5 - Reflected Cross-Site Scripting
High
CVE-2023-40215
Demon image annotation <= 5.3 - Authenticated (Administrator+) SQL Injection
Medium
CVE-2023-39992
Online Booking & Scheduling Calendar for WordPress by vcita <= 4.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2023-39312
Avada <= 7.11.1 - Authenticated(Author+) Arbitrary File Upload via Zip Extraction
Medium
CVE-2023-40213
Justified Gallery <= 1.7.3 - Missing Authorization via 'dismiss_how_to_use_notice' and 'dismiss_notice'
Medium
CVE-2023-39922
Avada <= 7.11.1 - Missing Authorization
Medium
CVE-2023-37393
Atarim <= 3.9.3 - Reflected Cross-Site Scripting
Medium
CVE-2023-39306
Fusion Builder <= 3.11.1 - Reflected Cross-Site Scripting via User Register Element
High
CVE-2023-39307
Avada <= 7.11.1 - Authenticated(Contributor+) Arbitrary File Upload via 'ajax_import_options'
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.