Security
Headlines
HeadlinesLatestCVEs

Tag

#wordpress

CVE-2023-34368: WordPress Kanban Boards for WordPress plugin <= 2.5.20 - Cross Site Scripting (XSS) vulnerability - Patchstack

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Kanban for WordPress Kanban Boards for WordPress plugin <= 2.5.20 versions.

CVE
Open in Source
#xss#vulnerability#web#wordpress#auth
CVE-2023-32239: WordPress Woodmart theme <= 7.2.1 - Cross-Site Scripting (XSS) vulnerability - Patchstack

Auth. (subscriber+) Stored Cross-Site Scripting (XSS) vulnerability in xtemos WoodMart theme <= 7.2.1 versions.

CVE-2023-28774: WordPress Review Stream plugin <= 1.6.5 - Cross Site Scripting (XSS) - Patchstack

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Grade Us, Inc. Review Stream plugin <= 1.6.5 versions.

CVE-2023-28418: WordPress Mediciti Lite theme <= 1.3.0 - Reflected Cross Site Scripting (XSS) vulnerability - Patchstack

Auth. (subscriber+) Reflected Cross-Site Scripting (XSS) vulnerability in Yudlee themes Mediciti Lite theme <= 1.3.0 versions.

CVE-2022-47593: WordPress RapidLoad Power-Up for Autoptimize plugin <= 1.6.35 - SQL Injection - Patchstack

Auth. (subscriber+) SQL Injection (SQLi) vulnerability in RapidLoad RapidLoad Power-Up for Autoptimize plugin <= 1.6.35 versions.

CVE-2023-32960: WordPress UpdraftPlus plugin <= 1.23.3 - CSRF lead to wp-admin Site Wide XSS vulnerability - Patchstack

Cross-Site Request Forgery (CSRF) vulnerability in UpdraftPlus.Com, DavidAnderson UpdraftPlus WordPress Backup Plugin <= 1.23.3 versions leads to sitewide Cross-Site Scripting (XSS).

WordPress BackUpWordPress 3.8 Backup Disclosure

WordPress BackUpWordPress version 3.8 appears to leave backups in a world accessible directory under the document root.

CVE-2023-35918: WordPress WooCommerce Bulk Stock Management plugin <= 2.2.33 - Cross Site Scripting (XSS) vulnerability - Patchstack

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WooCommerce Bulk Stock Management plugin <= 2.2.33 versions.

CVE-2023-35093: WordPress MasterStudy LMS plugin <= 3.0.8 - Broken Access Control vulnerability - Patchstack

Broken Access Control vulnerability in StylemixThemes MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin <= 3.0.8 versions allows any logged-in users, such as subscribers to view the "Orders" of the plugin and get the data related to the order like email, username, and more.