Medium
CVE-2023-4798
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,681
Reset filters
High
CVE-2023-4971
Weaver Xtreme Theme Support <= 6.3.0 - Authenticated (Administrator+) PHP Object Injection via Imported File
Medium
9f23bf62-6008-4a9c-a7ae-a2e513699684
ShortPixel Image Optimizer <= 5.4.1 - Authenticated(Editor+) PHP Object Injection
Medium
CVE-2023-4643
Enable Media Replace <= 4.1.2 - Authenticated(Author+) PHP Object Injection
High
CVE-2023-4386
Essential Blocks <= 4.2.0 - Unauthenticated PHP Object Injection via queries
High
CVE-2023-4402
Essential Blocks <= 4.2.0 - Unauthenticated PHP Object Injection via products
High
CVE-2023-41243
WPvivid Backup Plugin <= 0.9.90 - Missing Authorization via 'start_staging' and 'get_staging_progress'
High
CVE-2023-3392
Read More & Accordion <= 3.2.6.1 - Authenticated (Administrator+) PHP Object Injection
Medium
CVE-2023-41953
ProfilePress <= 4.13.1 Cross-Site Request Forgery via 'admin_notice'
High
CVE-2023-41954
ProfilePress <= 4.13.1 - Limited Privilege Escalation via 'acceptable_defined_roles'
Medium
CVE-2023-41805
Starter Templates <= 3.2.5 - Incorrect Authorization
Critical
CVE-2023-40555
Flatsome <= 3.17.5 - Unauthenticated PHP Object Injection
Medium
CVE-2023-41804
Starter Templates <= 3.2.4 - Authenticated (Contributor+) Server-Side Request Forgery
Critical
CVE-2023-25054
RSVPMaker <= 10.6.6 - Unauthenticated PHP Object Injection
High
CVE-2023-34383
WP Project Manager <= 2.6.0 - Authenticated (Subscriber+) SQL Injection
Medium
CVE-2023-4471
Order Tracking Pro <= 3.3.6 - Reflected Cross-Site Scripting
Medium
CVE-2023-40331
Accordion Slider <= 1.9.6 - Missing Authorization to Notice Dismissal
Medium
CVE-2023-49765
Rate my Post - WP Rating System <= 3.4.1 - Insecure Direct Object Reference
Medium
CVE-2023-37393
Atarim <= 3.9.3 - Reflected Cross-Site Scripting
Medium
CVE-2023-3360
Weaver Show Posts <= 1.8.0 - Authenticated (Administrator+) PHP Object Injection
Critical
CVE-2023-37390
Themesflat Addons For Elementor <= 2.0.0 - Unauthenticated PHP Object Injection
Medium
CVE-2023-41874
Order Delivery Date for WooCommerce <= 3.20.0 - Reflected Cross-Site Scripting via 'orddd_lite_custom_startdate' and 'orddd_lite_custom_enddate'
Medium
CVE-2023-25980
Optimize Database after Deleting Revisions <= 5.1.1 - Cross-Site Request Forgery via 'odb_start_manually'
Medium
CVE-2023-33999
Freemius SDK <= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.