Medium
CVE-2023-0691
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 8,950
Reset filters
Medium
CVE-2023-0710
Metform Elementor Contact Form Builder <= 3.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via mf_thankyou shortcode
Medium
CVE-2023-0688
Metform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via mf_thankyou shortcode
Medium
CVE-2023-0709
Metform Elementor Contact Form Builder <= 3.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via mf_last_name shortcode
Medium
CVE-2023-0693
Metform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via 'mf_transaction_id' shortcode
Medium
CVE-2023-0694
Metform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via mf shortcode
Medium
CVE-2023-34382
Dokan <=3.7.19 - Authenticated(Shop Manager+) PHP Object Injection via create_dummy_vendor
Medium
CVE-2023-2605
WP Brutal AI < 2.0.1 - Reflected Cross-Site Scripting
High
CVE-2023-2601
WP Brutal AI < 2.0.0 - Cross-Site Request Forgery to SQL Injection
Medium
CVE-2023-2623
KiviCare – Clinic & Patient Management System (EHR) <= 3.2.0 - Sensitive Information Exposure
High
CVE-2023-2781
User Email Verification for WooCommerce <= 3.5.0 - Authentication Bypass
Medium
CVE-2023-2404
CRM and Lead Management by vcita <= 2.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Low
b9002f6e-4345-4908-9cb8-9841a2458eb7
CartFlows <= 1.11.11 - Insecure Direct Object Reference to Arbitrary Post Deletion
Medium
CVE-2023-2302
Contact Form and Calls To Action by vcita <= 2.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2023-2407
Event Registration Calendar By vcita <= 1.3.1 & Online Payments – Get Paid with PayPal, Square & Stripe <= 3.10.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Medium
CVE-2023-2406
Event Registration Calendar By vcita <= 1.3.1 & Online Payments – Get Paid with PayPal, Square & Stripe <= 3.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2023-2300
Contact Form Builder by vcita <= 4.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2023-1430
FluentCRM - Marketing Automation For WordPress <= 2.8.01 - Insufficient Use of Hash as Authorization Control
High
CVE-2023-2201
Web Directory Free <= 1.6.8 - Authenticated (Contributor+) SQL Injection via post_id
Medium
CVE-2023-1889
Directorist <= 7.5.4 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Post Deletion in listing_task
High
CVE-2023-1888
Directorist <= 7.5.4 - Authenticated (Subscriber+) Arbitrary User Password Reset to Privilege Escalation
Medium
CVE-2023-2877
Formidable Forms <= 6.3 - Authenticated (Subscriber+) Arbitrary Plugin Installation and Activation
Low
CVE-2023-2897
Brizy Page Builder <= 2.4.18 - IP Address Spoofing to Protection Mechanism Bypass
Medium
3c8602ed-6c0d-4357-93e6-bab1ab38ffb2
Donation Platform for WooCommerce: Fundraising & Donation Management <= 1.2.9 - Cross-Site Request Forgery to Survey Submission
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.