High
CVE-2023-4276
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,587
Medium
CVE-2023-39988
WxSync <= 2.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2023-4283
EmbedPress <= 3.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Critical
CVE-2023-3452
Canto <= 3.0.4 - Unauthenticated Remote File Inclusion
Critical
a4562535-ef69-4337-b03e-0b7c869cb042
Kadence Blocks <= 3.1.10 - Unauthenticated Arbitrary File Upload
Medium
CVE-2023-4282
EmbedPress <= 3.8.2 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Delete via admin_post_remove and remove_private_data
High
CVE-2023-28170
Theme Demo Import <= 1.1.3 - Authenticated (Administrator+) Arbitrary File Upload
Medium
CVE-2023-39991
BigBlueButton <= 3.0.0-beta.4 - Reflected Cross-Site Scripting
High
CVE-2023-4277
Realia <= 1.4.0 - Cross-Site Request Forgery to User Email Change
Medium
CVE-2023-39987
wSecure Lite <= 2.5 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings
High
CVE-2023-38704
import-in-the-middle has unsanitized user controlled input in module generation
High
CVE-2023-3894
Denial of service in jackson-dataformat-toml
High
CVE-2023-38759
Cross Site Request Forgery (CSRF) vulnerability in wger Project wger Workout Manager 2.2.0a3 allows a remote attacker to gain privileges via the user-management feature in the gym/views/gym.py, templa
Medium
CVE-2023-38758
Cross Site Scripting vulnerability in wger Project wger Workout Manager v.2.2.0a3 allows a remote attacker to gain privileges via the license_author field in the add-ingredient function in the templat
Medium
f5b08a10-f6bc-44a0-865a-5ad71a1772f7
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.6.8 - Cross-Site Request Forgery
High
CVE-2023-4239
Real Estate Manager <= 7.2 - Arbitrary Usermeta Update to Authenticated (Subscriber+) Privilege Escalation
High
CVE-2023-4269
User Activity Log <= 1.6.5 - Unauthenticated Data Export to Sensitive Information Disclosure
Medium
CVE-2023-39990
Paid Memberships Pro - Courses for Membership Add On <= 1.2.3 - Missing Authorization to Authenticated (Subscriber+) Course Modifications
Critical
b280155e-6d07-448d-922c-4a0ea21f4992
Biometric Login for WooCommerce <= 1.0.3 - Unauthenticated Privilege Escalation
Medium
CVE-2023-4242
FULL - Customer <= 2.2.3 - Authenticated(Subscriber+) Information Disclosure via Health Check
High
CVE-2023-4243
FULL - Customer <= 2.2.3 - Authenticated(Subscriber+) Improper Authorization to Arbitrary Plugin Installation
Medium
CVE-2023-4059
Profile Builder <= 3.9.7 - Missing Authorization to Initial Page Creation
Medium
55fac183-bd8d-4e16-b25a-784861897deb
Paid Memberships Pro - Courses for Membership Add On <= 1.2.4 - Authenticated (Admin+) Stored Cross-Site Scripting
Medium
CVE-2023-3360
Weaver Show Posts <= 1.8.0 - Authenticated (Administrator+) PHP Object Injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.