deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-41556
Published: 2023-08-30
Description: Tenda AC7 V1.0 V15.03.06.44, Tenda AC9 V3.0 V15.03.06.42_multi, and Tenda AC5 V1.0RTL_V15.03.06.28 were discovered to contain a stack overflow via parameter list at url /goform/SetIpMacBind.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/peris-navince/founded-0-days/blob/main/fromSetIpMacBind/1.md; https://github.com/peris-navince/founded-0-days/blob/main/fromSetIpMacBind/1.md
CVE: CVE-2023-41557
Published: 2023-08-30
Description: Tenda AC7 V1.0 V15.03.06.44 and Tenda AC5 V1.0RTL_V15.03.06.28 were discovered to contain a stack overflow via parameter entrys and mitInterface at url /goform/addressNat.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/peris-navince/founded-0-days/blob/main/fromAddressNat/1.md; https://github.com/peris-navince/founded-0-days/blob/main/fromAddressNat/1.md
CVE: CVE-2023-41558
Published: 2023-08-30
Description: Tenda AC7 V1.0 V15.03.06.44 was discovered to contain a stack overflow via parameter timeZone at url /goform/SetSysTimeCfg.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/peris-navince/founded-0-days/blob/main/fromSetSysTime/1.md; https://github.com/peris-navince/founded-0-days/blob/main/fromSetSysTime/1.md
CVE: CVE-2023-41559
Published: 2023-08-30
Description: Tenda AC7 V1.0 V15.03.06.44, Tenda AC9 V3.0 V15.03.06.42_multi, and Tenda AC5 V1.0RTL_V15.03.06.28 were discovered to contain a stack overflow via parameter page at url /goform/NatStaticSetting.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/peris-navince/founded-0-days/blob/main/fromNatStaticSetting/1.md; https://github.com/peris-navince/founded-0-days/blob/main/fromNatStaticSetting/1.md
CVE: CVE-2023-41560
Published: 2023-08-30
Description: Tenda AC9 V3.0 V15.03.06.42_multi was discovered to contain a stack overflow via parameter firewallEn at url /goform/SetFirewallCfg.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/peris-navince/founded-0-days/blob/main/formSetFirewallCfg/1.md; https://github.com/peris-navince/founded-0-days/blob/main/formSetFirewallCfg/1.md
CVE: CVE-2023-41561
Published: 2023-08-30
Description: Tenda AC9 V3.0 V15.03.06.42_multi and Tenda AC5 US_AC5V1.0RTL_V15.03.06.28 were discovered to contain a stack overflow via parameter startIp and endIp at url /goform/SetPptpServerCfg.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/peris-navince/founded-0-days/blob/main/formSetPPTPServer/1.md; https://github.com/peris-navince/founded-0-days/blob/main/formSetPPTPServer/1.md
CVE: CVE-2023-41562
Published: 2023-08-30
Description: Tenda AC7 V1.0 V15.03.06.44, Tenda AC9 V3.0 V15.03.06.42_multi, and Tenda AC5 US_AC5V1.0RTL_V15.03.06.28 were discovered to contain a stack overflow via parameter time at url /goform/PowerSaveSet.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/peris-navince/founded-0-days/blob/main/setSmartPowerManagement/1.md; https://github.com/peris-navince/founded-0-days/blob/main/setSmartPowerManagement/1.md
CVE: CVE-2023-41563
Published: 2023-08-30
Description: Tenda AC9 V3.0 V15.03.06.42_multi and Tenda AC5 US_AC5V1.0RTL_V15.03.06.28 were discovered to contain a stack overflow via parameter mac at url /goform/GetParentControlInfo.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/peris-navince/founded-0-days/blob/main/GetParentControlInfo/1.md; https://github.com/peris-navince/founded-0-days/blob/main/GetParentControlInfo/1.md
CVE: CVE-2023-4624
Published: 2023-08-30
Description: Server-Side Request Forgery (SSRF) in GitHub repository bookstackapp/bookstack prior to v23.08.
CVSS Score: 2.4 (LOW)
CWE: CWE-918, CWE-918
References: https://github.com/bookstackapp/bookstack/commit/c324ad928dbdd54ce5b09eb0dabe60ef9de1ea38; https://huntr.dev/bounties/9ce5cef6-e546-44e7-addf-a2726fa4e60c; https://github.com/bookstackapp/bookstack/commit/c324ad928dbdd54ce5b09eb0dabe60ef9de1ea38
CVE: CVE-2023-34174
Published: 2023-08-30
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in BBS e-Theme BBS e-Popup plugin <= 2.4.5 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/bbs-e-popup/wordpress-bbs-e-popup-plugin-2-4-5-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/bbs-e-popup/wordpress-bbs-e-popup-plugin-2-4-5-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-34175
Published: 2023-08-30
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in GrandSlambert Login Configurator plugin <= 2.1 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/login-configurator/wordpress-login-configurator-plugin-2-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/login-configurator/wordpress-login-configurator-plugin-2-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-34176
Published: 2023-08-30
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Chilexpress Chilexpress woo oficial plugin <= 1.2.9 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/chilexpress-oficial/wordpress-chilexpress-woo-oficial-plugin-1-2-9-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/chilexpress-oficial/wordpress-chilexpress-woo-oficial-plugin-1-2-9-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-34180
Published: 2023-08-30
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in KAPlugins Google Fonts For WordPress plugin <= 3.0.0 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/free-google-fonts/wordpress-google-fonts-for-wordpress-plugin-3-0-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/free-google-fonts/wordpress-google-fonts-for-wordpress-plugin-3-0-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-34183
Published: 2023-08-30
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Valiano Unite Gallery Lite plugin <= 1.7.61 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/unite-gallery-lite/wordpress-unite-gallery-lite-plugin-1-7-60-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/unite-gallery-lite/wordpress-unite-gallery-lite-plugin-1-7-60-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-34184
Published: 2023-08-30
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Bhavik Patel Woocommerce Order address Print plugin <= 3.2 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/woocommerce-order-address-print/wordpress-woocommerce-order-address-print-plugin-3-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/woocommerce-order-address-print/wordpress-woocommerce-order-address-print-plugin-3-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-34187
Published: 2023-08-30
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Alan Tien Call Now Icon Animate plugin <= 0.1.0 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/call-now-icon-animate/wordpress-call-now-icon-animate-plugin-0-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/call-now-icon-animate/wordpress-call-now-icon-animate-plugin-0-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-41537
Published: 2023-08-30
Description: phpjabbers Business Directory Script 3.2 is vulnerable to Cross Site Scripting (XSS) via the keyword parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/phpjabbers/2023/Business-Directory-Script-Version-3.2; https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/phpjabbers/2023/Business-Directory-Script-Version%3A3.2
CVE: CVE-2023-41538
Published: 2023-08-30
Description: phpjabbers PHP Forum Script 3.0 is vulnerable to Cross Site Scripting (XSS) via the keyword parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/phpjabbers/2023/PHP-Forum-Script-3.0; https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/phpjabbers/2023/PHP-Forum-Script-3.0
CVE: CVE-2023-41539
Published: 2023-08-30
Description: phpjabbers Business Directory Script 3.2 is vulnerable to SQL Injection via the column parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/phpjabbers/2023/Business-Directory-Script-Version%3A3.2/SQLi; https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/phpjabbers/2023/Business-Directory-Script-Version%3A3.2/SQLi
CVE: CVE-2022-1601
Published: 2023-08-30
Description: The User Access Manager WordPress plugin before 2.2.18 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDR, which makes it possible for attackers to access restricted content in certain situations.
CVSS Score: 5.3 (MEDIUM)
References: https://wpscan.com/vulnerability/f6d3408c-2ceb-4a89-822b-13f5272a5fce; https://wpscan.com/vulnerability/f6d3408c-2ceb-4a89-822b-13f5272a5fce
CVE: CVE-2023-1982
Published: 2023-08-30
Description: The Front Editor WordPress plugin through 4.0.4 does not sanitize and escape some of its form settings, which could allow high-privilege users to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 4.8 (MEDIUM)
References: https://wpscan.com/vulnerability/5[PII_REDACTED]-4e12-bc2e-997b92054739; https://wpscan.com/vulnerability/5[PII_REDACTED]-4e12-bc2e-997b92054739
CVE: CVE-2023-34004
Published: 2023-08-30
Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in WooCommerce WooCommerce Box Office plugin <= 1.1.50 versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/woocommerce-box-office/wordpress-woocommerce-box-office-plugin-1-1-50-contributor-stored-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/woocommerce-box-office/wordpress-woocommerce-box-office-plugin-1-1-50-contributor-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-34008
Published: 2023-08-30
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in weDevs WP ERP plugin <= 1.12.3 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/erp/wordpress-wp-erp-plugin-1-12-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/erp/wordpress-wp-erp-plugin-1-12-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-34022
Published: 2023-08-30
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Rakib Hasan Dynamic QR Code Generator plugin <= 0.0.5 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/dynamic-qr-code-generator/wordpress-dynamic-qr-code-generator-plugin-0-0-5-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/dynamic-qr-code-generator/wordpress-dynamic-qr-code-generator-plugin-0-0-5-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-34023
Published: 2023-08-30
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Miled WordPress Social Login plugin <= 3.0.4 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/wordpress-social-login/wordpress-wordpress-social-login-plugin-3-0-4-cross-site-scripting-xss-vulnerability-2?_s_id=cve; https://patchstack.com/database/vulnerability/wordpress-social-login/wordpress-wordpress-social-login-plugin-3-0-4-cross-site-scripting-xss-vulnerability-2?_s_id=cve
CVE: CVE-2023-34032
Published: 2023-08-30
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Pascal Casier bbPress Toolkit plugin <= 1.0.12 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/bbp-toolkit/wordpress-bbpress-toolkit-plugin-1-0-12-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/bbp-toolkit/wordpress-bbpress-toolkit-plugin-1-0-12-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-34172
Published: 2023-08-30
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Miled WordPress Social Login plugin <= 3.0.4 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/wordpress-social-login/wordpress-wordpress-social-login-plugin-3-0-4-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wordpress-social-login/wordpress-wordpress-social-login-plugin-3-0-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-34173
Published: 2023-08-30
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Alexander Semikashev Yandex Metrica Counter plugin <= 1.4.3 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/counter-yandex-metrica/wordpress-yandex-metrica-counter-plugin-1-4-3-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/counter-yandex-metrica/wordpress-yandex-metrica-counter-plugin-1-4-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-3356
Published: 2023-08-30
Description: The Subscribers Text Counter WordPress plugin before 1.7.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack, which also lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/93faad5b-e1e8-4e49-b19e-b91343d68b51; https://wpscan.com/vulnerability/93faad5b-e1e8-4e49-b19e-b91343d68b51
CVE: CVE-2023-3501
Published: 2023-08-30
Description: The FormCraft WordPress plugin before 1.2.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
References: https://wpscan.com/vulnerability/d3fb4a2b-ed51-4654-b7c1-4b0f59cd1ecf; https://wpscan.com/vulnerability/d3fb4a2b-ed51-4654-b7c1-4b0f59cd1ecf
CVE: CVE-2023-3720
Published: 2023-08-30
Description: The Upload Media By URL WordPress plugin before 1.0.8 does not have CSRF check when uploading files, which could allow attackers to make logged in admins upload files (including HTML containing JS code for users with the unfiltered_html capability) on their behalf.
CVSS Score: 6.5 (MEDIUM)
References: https://wpscan.com/vulnerability/16375a7f-0a9f-4961-8510-d047ffbf3954; https://wpscan.com/vulnerability/16375a7f-0a9f-4961-8510-d047ffbf3954
CVE: CVE-2023-3992
Published: 2023-08-30
Description: The PostX WordPress plugin before 3.0.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
CVSS Score: 6.1 (MEDIUM)
References: https://wpscan.com/vulnerability/c43b669f-0377-4402-833c-817b75001888; https://wpscan.com/vulnerability/c43b669f-0377-4402-833c-817b75001888
CVE: CVE-2023-4013
Published: 2023-08-30
Description: The GDPR Cookie Compliance (CCPA, DSGVO, Cookie Consent) WordPress plugin before 4.12.5 does not have proper CSRF checks when managing its license, which could allow attackers to make logged in admins update and deactivate the plugin's license via CSRF attacks
CVSS Score: 6.5 (MEDIUM)
References: https://wpscan.com/vulnerability/54e4494c-a280-4d91-803d-7d55159cdbc5; https://wpscan.com/vulnerability/54e4494c-a280-4d91-803d-7d55159cdbc5
CVE: CVE-2023-4023
Published: 2023-08-30
Description: The All Users Messenger WordPress plugin through 1.24 does not prevent non-administrator users from deleting messages from the all-users messenger.
CVSS Score: 4.3 (MEDIUM)
References: https://wpscan.com/vulnerability/682c0226-28bd-4051-830d-8b679626213d; https://wpscan.com/vulnerability/682c0226-28bd-4051-830d-8b679626213d
CVE: CVE-2023-4035
Published: 2023-08-30
Description: The Simple Blog Card WordPress plugin before 1.31 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/8fd9192a-2d08-4127-adcd-87fb1ea8d6fc; https://wpscan.com/vulnerability/8fd9192a-2d08-4127-adcd-87fb1ea8d6fc
CVE: CVE-2023-4036
Published: 2023-08-30
Description: The Simple Blog Card WordPress plugin before 1.32 does not ensure that posts to be displayed via a shortcode are public, allowing any authenticated users, such as subscriber, to retrieve arbitrary post title and their content such as draft, private and password protected ones
CVSS Score: 4.3 (MEDIUM)
References: https://wpscan.com/vulnerability/de3e1718-c358-4510-b142-32896ffeb03f; https://wpscan.com/vulnerability/de3e1718-c358-4510-b142-32896ffeb03f
CVE: CVE-2023-4109
Published: 2023-08-30
Description: The Ninja Forms WordPress Ninja Forms Contact Form WordPress plugin before 3.6.26 was affected by a HTML Injection security vulnerability.
CVSS Score: 4.8 (MEDIUM)
References: https://wpscan.com/vulnerability/558e06ab-704b-4bb1-ba7f-b5f6bbbd68d9; https://wpscan.com/vulnerability/558e06ab-704b-4bb1-ba7f-b5f6bbbd68d9
CVE: CVE-2023-4150
Published: 2023-08-30
Description: The User Activity Tracking and Log WordPress plugin before 4.0.9 does not have proper CSRF checks when managing its license, which could allow attackers to make logged in admins update and deactivate the plugin's license via CSRF attacks
CVSS Score: 4.3 (MEDIUM)
References: https://wpscan.com/vulnerability/381ef15b-aafe-4ef4-a0bc-867d891f7f44; https://wpscan.com/vulnerability/381ef15b-aafe-4ef4-a0bc-867d891f7f44
CVE: CVE-2023-4209
Published: 2023-08-30
Description: The POEditor WordPress plugin before 0.9.8 does not have CSRF checks in various places, which could allow attackers to make logged in admins perform unwanted actions, such as reset the plugin's settings and update its API key via CSRF attacks.
CVSS Score: 4.3 (MEDIUM)
References: https://wpscan.com/vulnerability/b2c6fa7d-1b0f-444b-8ca5-8c1c06cea1d9; https://wpscan.com/vulnerability/b2c6fa7d-1b0f-444b-8ca5-8c1c06cea1d9
CVE: CVE-2023-24397
Published: 2023-08-30
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Reservation.Studio Reservation.Studio widget plugin <= 1.0.11 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/reservation-studio-widget/wordpress-reservation-studio-widget-plugin-1-0-5-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/reservation-studio-widget/wordpress-reservation-studio-widget-plugin-1-0-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-24401
Published: 2023-08-30
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Davidsword Mobile Call Now & Map Buttons plugin <= 1.5.0 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/mobile-call-now-map-buttons/wordpress-mobile-call-now-map-buttons-plugin-1-5-0-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/mobile-call-now-map-buttons/wordpress-mobile-call-now-map-buttons-plugin-1-5-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-25453
Published: 2023-08-30
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Ian Sadovy WordPress Tables plugin <= 1.3.9 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/wptables/wordpress-wordpress-tables-plugin-1-3-9-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wptables/wordpress-wordpress-tables-plugin-1-3-9-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-25466
Published: 2023-08-30
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Mahlamusa Who Hit The Page – Hit Counter plugin <= 1.4.14.3 versions.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/who-hit-the-page-hit-counter/wordpress-who-hit-the-page-hit-counter-plugin-1-4-14-3-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/who-hit-the-page-hit-counter/wordpress-who-hit-the-page-hit-counter-plugin-1-4-14-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-25471
Published: 2023-08-30
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Webcodin WCP OpenWeather plugin <= 2.5.0 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/wcp-openweather/wordpress-wcp-openweather-plugin-2-5-0-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wcp-openweather/wordpress-wcp-openweather-plugin-2-5-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-27621
Published: 2023-08-30
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in MrDemonWolf Livestream Notice plugin <= 1.2.0 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/livestream-notice/wordpress-livestream-notice-plugin-1-2-0-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/livestream-notice/wordpress-livestream-notice-plugin-1-2-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-28415
Published: 2023-08-30
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in XootiX Side Cart Woocommerce (Ajax) plugin <= 2.2 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/side-cart-woocommerce/wordpress-side-cart-woocommerce-plugin-2-2-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/side-cart-woocommerce/wordpress-side-cart-woocommerce-plugin-2-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-28692
Published: 2023-08-30
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Kevon Adonis WP Abstracts plugin <= 2.6.3 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/wp-abstracts-manuscripts-manager/wordpress-wp-abstracts-plugin-2-6-2-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-abstracts-manuscripts-manager/wordpress-wp-abstracts-plugin-2-6-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-32294
Published: 2023-08-30
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Radical Web Design GDPR Cookie Consent Notice Box plugin <= 1.1.6 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/cookie-consent-box/wordpress-gdpr-cookie-consent-notice-box-plugin-1-1-6-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/cookie-consent-box/wordpress-gdpr-cookie-consent-notice-box-plugin-1-1-6-cross-site-scripting-xss-vulnerability?_s_id=cve