CyberAlerts

CVE-2023-2592

Description: The FormCraft WordPress plugin before 3.9.7 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin.

CVSS: LOW (0.0)

EPSS Score: 0.09%

Source: CVE

November 28th, 2024 (5 months ago)

CVE-2023-2482

Responsive CSS EDITOR <= 1.0 - Admin+ SQLi

Description: The Responsive CSS EDITOR WordPress plugin through 1.0 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high-privilege users such as admin.

CVSS: LOW (0.0)

EPSS Score: 0.1%

Source: CVE

November 28th, 2024 (5 months ago)

CVE-2023-2326

Gravity Forms Google Sheet Connector < 1.3.5 - Access Code Update via CSRF

Description: The Gravity Forms Google Sheet Connector WordPress plugin before 1.3.5, gsheetconnector-gravityforms-pro WordPress plugin through 1.3.5 does not have CSRF check when updating its Access Code, which could allow attackers to make logged in admin change the access code to an arbitrary one via a CSRF attack

CVSS: LOW (0.0)

EPSS Score: 0.07%

Source: CVE

November 28th, 2024 (5 months ago)

CVE-2023-2178

Aajoda Testimonials < 2.2.2 - Admin+ Stored XSS

Description: The Aajoda Testimonials WordPress plugin before 2.2.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

CVSS: LOW (0.0)

EPSS Score: 0.11%

Source: CVE

November 28th, 2024 (5 months ago)

CVE-2023-2068

File Manager Advanced Shortcode <= 2.3.2 - Unauthenticated Remote Code Execution through shortcode

Description: The File Manager Advanced Shortcode WordPress plugin through 2.3.2 does not adequately prevent uploading files with disallowed MIME types when using the shortcode. This leads to RCE in cases where the allowed MIME type list does not include PHP files. In the worst case, this is available to unauthenticated users.

CVSS: LOW (0.0)

EPSS Score: 83.95%

Source: CVE

November 28th, 2024 (5 months ago)

CVE-2023-2032

Custom 404 Pro < 3.8.1 - Multiple SQL Injection

Description: The Custom 404 Pro WordPress plugin before 3.8.1 does not properly sanitize database inputs, leading to multiple SQL Injection vulnerabilities.

CVSS: LOW (0.0)

EPSS Score: 0.21%

Source: CVE

November 28th, 2024 (5 months ago)

CVE-2023-1891

Accordion & FAQ < 1.9.9 - Reflected XSS

Description: The Accordion & FAQ WordPress plugin before 1.9.9 does not escape various generated URLs, before outputting them in attributes when some notices are displayed, leading to Reflected Cross-Site Scripting

CVSS: LOW (0.0)

EPSS Score: 0.07%

Source: CVE

November 28th, 2024 (5 months ago)

CVE-2023-1166

USM Premium < 16.3 - Admin+ Stored XSS

Description: The USM-Premium WordPress plugin before 16.3 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example, in multisite setup).

CVSS: LOW (0.0)

EPSS Score: 0.06%

Source: CVE

November 28th, 2024 (5 months ago)

CVE-2023-0873

Kanban Boards for WordPress < 2.5.21 - Admin+ Stored XSS

Description: The Kanban Boards for WordPress plugin before 2.5.21 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

CVSS: LOW (0.0)

EPSS Score: 0.06%

Source: CVE

November 28th, 2024 (5 months ago)

CVE-2023-0588

Catalyst Connect Zoho CRM Client Portal < 2.1.0 - Reflected XSS

Description: The Catalyst Connect Zoho CRM Client Portal WordPress plugin before 2.1.0 does not sanitize and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high-privilege users such as admin.

CVSS: LOW (0.0)

EPSS Score: 0.08%

Source: CVE

November 28th, 2024 (5 months ago)

Threat and Vulnerability Intelligence Database

Example Searches:

CVE-2023-2592	FormCraft Premium < 3.9.7 - Admin+ SQLi Description: The FormCraft WordPress plugin before 3.9.7 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin. CVSS: LOW (0.0) EPSS Score: 0.09% Source: CVE November 28th, 2024 (5 months ago)
CVE-2023-2482	Responsive CSS EDITOR <= 1.0 - Admin+ SQLi Description: The Responsive CSS EDITOR WordPress plugin through 1.0 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high-privilege users such as admin. CVSS: LOW (0.0) EPSS Score: 0.1% Source: CVE November 28th, 2024 (5 months ago)
CVE-2023-2326	Gravity Forms Google Sheet Connector < 1.3.5 - Access Code Update via CSRF Description: The Gravity Forms Google Sheet Connector WordPress plugin before 1.3.5, gsheetconnector-gravityforms-pro WordPress plugin through 1.3.5 does not have CSRF check when updating its Access Code, which could allow attackers to make logged in admin change the access code to an arbitrary one via a CSRF attack CVSS: LOW (0.0) EPSS Score: 0.07% Source: CVE November 28th, 2024 (5 months ago)
CVE-2023-2178	Aajoda Testimonials < 2.2.2 - Admin+ Stored XSS Description: The Aajoda Testimonials WordPress plugin before 2.2.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). CVSS: LOW (0.0) EPSS Score: 0.11% Source: CVE November 28th, 2024 (5 months ago)
CVE-2023-2068	File Manager Advanced Shortcode <= 2.3.2 - Unauthenticated Remote Code Execution through shortcode Description: The File Manager Advanced Shortcode WordPress plugin through 2.3.2 does not adequately prevent uploading files with disallowed MIME types when using the shortcode. This leads to RCE in cases where the allowed MIME type list does not include PHP files. In the worst case, this is available to unauthenticated users. CVSS: LOW (0.0) EPSS Score: 83.95% Source: CVE November 28th, 2024 (5 months ago)
CVE-2023-2032	Custom 404 Pro < 3.8.1 - Multiple SQL Injection Description: The Custom 404 Pro WordPress plugin before 3.8.1 does not properly sanitize database inputs, leading to multiple SQL Injection vulnerabilities. CVSS: LOW (0.0) EPSS Score: 0.21% Source: CVE November 28th, 2024 (5 months ago)
CVE-2023-1891	Accordion & FAQ < 1.9.9 - Reflected XSS Description: The Accordion & FAQ WordPress plugin before 1.9.9 does not escape various generated URLs, before outputting them in attributes when some notices are displayed, leading to Reflected Cross-Site Scripting CVSS: LOW (0.0) EPSS Score: 0.07% Source: CVE November 28th, 2024 (5 months ago)
CVE-2023-1166	USM Premium < 16.3 - Admin+ Stored XSS Description: The USM-Premium WordPress plugin before 16.3 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example, in multisite setup). CVSS: LOW (0.0) EPSS Score: 0.06% Source: CVE November 28th, 2024 (5 months ago)
CVE-2023-0873	Kanban Boards for WordPress < 2.5.21 - Admin+ Stored XSS Description: The Kanban Boards for WordPress plugin before 2.5.21 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) CVSS: LOW (0.0) EPSS Score: 0.06% Source: CVE November 28th, 2024 (5 months ago)
CVE-2023-0588	Catalyst Connect Zoho CRM Client Portal < 2.1.0 - Reflected XSS Description: The Catalyst Connect Zoho CRM Client Portal WordPress plugin before 2.1.0 does not sanitize and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high-privilege users such as admin. CVSS: LOW (0.0) EPSS Score: 0.08% Source: CVE November 28th, 2024 (5 months ago)