WordPress CVEs

CVE-2023-0726 February 8, 2023

The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.18.16. This is due to missing or incorrect nonce validation on the ajax_edit_folder function. This makes… Full details

MEDIUM 4.3

CVE-2023-0725 February 8, 2023

The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.18.16. This is due to missing or incorrect nonce validation on the ajax_clone_folder function. This makes… Full details

MEDIUM 4.3

CVE-2023-0724 February 8, 2023

The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.18.16. This is due to missing or incorrect nonce validation on the ajax_add_folder function. This makes… Full details

MEDIUM 4.3

CVE-2023-0722 February 8, 2023

The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.18.16. This is due to missing or incorrect nonce validation on the ajax_save_state function. This makes… Full details

MEDIUM 4.3

CVE-2023-0720 February 8, 2023

The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajax_save_folder_order function in versions up to, and including, 2.18.16. This makes it possible for authenticated… Full details

MEDIUM 4.3

CVE-2023-0717 February 8, 2023

The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajax_delete_folder function in versions up to, and including, 2.18.16. This makes it possible for authenticated… Full details

MEDIUM 4.3

CVE-2023-0716 February 8, 2023

The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajax_edit_folder function in versions up to, and including, 2.18.16. This makes it possible for authenticated… Full details

MEDIUM 4.3

CVE-2023-0715 February 8, 2023

The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajax_clone_folder function in versions up to, and including, 2.18.16. This makes it possible for authenticated… Full details

MEDIUM 4.3

CVE-2023-0711 February 8, 2023

The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajax_save_state function in versions up to, and including, 2.18.16. This makes it possible for authenticated… Full details

MEDIUM 4.3

CVE-2023-0685 February 8, 2023

The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.18.16. This is due to missing or incorrect nonce validation on the ajax_unassign_folders function. This makes… Full details

MEDIUM 4.3

CVE-2023-0684 February 8, 2023

The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajax_unassign_folders function in versions up to, and including, 2.18.16. This makes it possible for authenticated… Full details

MEDIUM 4.3

CVE-2023-0718 February 8, 2023

The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajax_save_folder function in versions up to, and including, 2.18.16. This makes it possible for authenticated… Full details

MEDIUM 4.3

CVE-2023-0731 February 7, 2023

The Interactive Geo Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the action content parameter in versions up to, and including, 1.5.9 due to insufficient input sanitization and output escaping on… Full details

MEDIUM 5.4

CVE-2023-0730 February 7, 2023

The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.18.16. This is due to missing or incorrect nonce validation on the ajax_save_folder_order function. This makes… Full details

MEDIUM 4.3

CVE-2023-0727 February 7, 2023

The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.18.16. This is due to missing or incorrect nonce validation on the ajax_delete_folder function. This makes… Full details

MEDIUM 4.3

CVE-2023-0723 February 7, 2023

The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.18.16. This is due to missing or incorrect nonce validation on the ajax_move_object function. This makes… Full details

MEDIUM 4.3

CVE-2023-0719 February 7, 2023

The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajax_save_sort_order function in versions up to, and including, 2.18.16. This makes it possible for authenticated… Full details

MEDIUM 4.3

CVE-2023-0712 February 7, 2023

The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajax_move_object function in versions up to, and including, 2.18.16. This makes it possible for authenticated… Full details

MEDIUM 4.3

CVE-2023-0728 February 7, 2023

The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.18.16. This is due to missing or incorrect nonce validation on the ajax_save_folder function. This makes… Full details

MEDIUM 4.3

CVE-2023-0713 February 7, 2023

The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajax_add_folder function in versions up to, and including, 2.18.16. This makes it possible for authenticated… Full details

MEDIUM 4.3

CVE-2023-0282 February 6, 2023

The YourChannel WordPress plugin before 1.2.2 does not sanitize and escape some parameters, which could allow users with a role as low as Subscriber to perform Cross-Site Scripting attacks. Full details

MEDIUM 5.4

CVE-2023-0252 February 6, 2023

The Contextual Related Posts WordPress plugin before 3.3.1 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users… Full details

MEDIUM 5.4

CVE-2023-0236 February 6, 2023

The Tutor LMS WordPress plugin before 2.0.10 does not sanitise and escape the reset_key and user_id parameters before outputting then back in attributes, leading to Reflected Cross-Site Scripting which could be used against high… Full details

MEDIUM 6.1

CVE-2023-0234 February 6, 2023

The SiteGround Security WordPress plugin before 1.3.1 does not properly sanitize user input before using it in an SQL query, leading to an authenticated SQL injection issue. Full details

HIGH 8.8

CVE-2023-0178 February 6, 2023

The Annual Archive WordPress plugin before 1.6.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with… Full details

MEDIUM 5.4

CVE-2023-0176 February 6, 2023

The Giveaways and Contests by RafflePress WordPress plugin before 1.11.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could… Full details

MEDIUM 5.4

CVE-2023-0174 February 6, 2023

The WP VR WordPress plugin before 8.2.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with… Full details

MEDIUM 5.4

CVE-2023-0173 February 6, 2023

The Drag & Drop Sales Funnel Builder for WordPress plugin before 2.6.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed,… Full details

MEDIUM 5.4

CVE-2023-0171 February 6, 2023

The jQuery T(-) Countdown Widget WordPress plugin before 2.3.24 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow… Full details

MEDIUM 5.4

CVE-2023-0170 February 6, 2023

The Html5 Audio Player WordPress plugin before 2.1.12 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users… Full details

MEDIUM 5.4

CVE-2023-0154 February 6, 2023

The GamiPress WordPress plugin before 1.0.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the… Full details

MEDIUM 5.4

CVE-2023-0153 February 6, 2023

The Vimeo Video Autoplay Automute WordPress plugin through 1.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow… Full details

MEDIUM 5.4

CVE-2023-0150 February 6, 2023

The Cloak Front End Email WordPress plugin before 1.9.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow… Full details

MEDIUM 5.4

CVE-2023-0149 February 6, 2023

The WordPrezi WordPress plugin before 0.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the… Full details

MEDIUM 5.4

CVE-2023-0148 February 6, 2023

The Gallery Factory Lite WordPress plugin through 2.0.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users… Full details

MEDIUM 5.4

CVE-2023-0147 February 6, 2023

The Flexible Captcha WordPress plugin through 4.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with… Full details

MEDIUM 5.4

CVE-2023-0146 February 6, 2023

The Naver Map WordPress plugin through 1.1.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with… Full details

MEDIUM 5.4

CVE-2023-0144 February 6, 2023

The Event Manager and Tickets Selling Plugin for WooCommerce WordPress plugin before 3.8.0 does not validate and escape some of its post meta before outputting them back in a page/post, which could allow users… Full details

MEDIUM 5.4

CVE-2023-0143 February 6, 2023

The Send PDF for Contact Form 7 WordPress plugin before 0.9.9.2 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a… Full details

MEDIUM 5.4

CVE-2023-0096 February 6, 2023

The Happyforms WordPress plugin before 1.22.0 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the… Full details

MEDIUM 5.4

CVE-2023-0095 February 6, 2023

The Page View Count WordPress plugin before 2.6.1 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users… Full details

MEDIUM 5.4

CVE-2023-0082 February 6, 2023

The ExactMetrics WordPress plugin before 7.12.1 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the… Full details

MEDIUM 5.4

CVE-2023-0081 February 6, 2023

The MonsterInsights WordPress plugin before 8.12.1 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the… Full details

MEDIUM 5.4

CVE-2023-0072 February 6, 2023

The WC Vendors Marketplace WordPress plugin before 2.4.5 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users… Full details

MEDIUM 5.4

CVE-2023-0070 February 6, 2023

The ResponsiveVoice Text To Speech WordPress plugin before 1.7.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow… Full details

MEDIUM 5.4

CVE-2023-0062 February 6, 2023

The EAN for WooCommerce WordPress plugin before 4.4.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users… Full details

MEDIUM 5.4

CVE-2022-4838 February 6, 2023

The Clean Login WordPress plugin before 1.13.7 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as… Full details

MEDIUM 5.4

CVE-2022-4836 February 6, 2023

The Breadcrumb WordPress plugin before 1.5.33 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor… Full details

MEDIUM 5.4

CVE-2022-4833 February 6, 2023

The YourChannel: Everything you want in a YouTube plugin WordPress plugin before 1.2.3 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users… Full details

MEDIUM 5.4

CVE-2022-4826 February 6, 2023

The Simple Tooltips WordPress plugin before 2.1.4 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with… Full details

MEDIUM 5.4