sales@hackhalt.com
Free Download Free Download Free Download
Explore Pricing Explore Pricing Explore Pricing

Blog

"Prevention is cheaper than a breach"

Live Vulnerability Intelligence

Threat Database

Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.

Total16,306
Critical1,017
High3,377
Medium11,647
Reset
Showing 13821-13840 of 16306 records
Threat Entry Updated 2025-02-19

CVE-2023-0272 - Nex Forms Plugin

The NEX-Forms WordPress plugin before 8.3.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks

PLUGIN Nex Forms

CVE-2023-0272

MEDIUM CVSS 5.4 2023-03-27
Open Full Technical Breakdown
Threat Entry Updated 2025-02-25

CVE-2023-28666 - Inpost Gallery Plugin

The InPost Gallery WordPress plugin, in versions < 2.2.2, is affected by a reflected cross-site scripting vulnerability in the 'imgurl' parameter to the add_inpost_gallery_slide_item action, which can only be triggered by an authenticated user.

PLUGIN Inpost Gallery

CVE-2023-28666

MEDIUM CVSS 5.4 2023-03-22
Open Full Technical Breakdown
Threat Entry Updated 2025-02-25

CVE-2023-28665 - Woo Bulk Price Update Plugin

The Woo Bulk Price Update WordPress plugin, in versions < 2.2.2, is affected by a reflected cross-site scripting vulnerability in the 'page' parameter to the techno_get_products action, which can only be triggered by an authenticated user.

PLUGIN Woo Bulk Price Update

CVE-2023-28665

MEDIUM CVSS 5.4 2023-03-22
Open Full Technical Breakdown
Threat Entry Updated 2025-02-25

CVE-2023-28664 - Meta Data And Taxonomies Filter Plugin

The Meta Data and Taxonomies Filter WordPress plugin, in versions < 1.3.1, is affected by a reflected cross-site scripting vulnerability in the 'tax_name' parameter of the mdf_get_tax_options_in_widget action, which can only be triggered by an authenticated user.

PLUGIN Meta Data And Taxonomies Filter

CVE-2023-28664

MEDIUM CVSS 5.4 2023-03-22
Open Full Technical Breakdown
Threat Entry Updated 2025-02-25

CVE-2023-28663 - Formidable Pro2pdf Plugin

The Formidable PRO2PDF WordPress Plugin, version < 3.11, is affected by an authenticated SQL injection vulnerability in the ‘fieldmap’ parameter in the fpropdf_export_file action.

PLUGIN Formidable Pro2pdf

CVE-2023-28663

HIGH CVSS 8.8 2023-03-22
Open Full Technical Breakdown
Threat Entry Updated 2025-02-26

CVE-2023-0940 - Before 5 Plugin

The ProfileGrid WordPress plugin before 5.3.1 provides an AJAX endpoint for resetting a user password but does not implement proper authorization. This allows a user with low privileges, such as subscriber, to change the password of any account, including Administrator ones.

PLUGIN Before 5

CVE-2023-0940

HIGH CVSS 8.8 2023-03-20
Open Full Technical Breakdown
Threat Entry Updated 2025-02-26

CVE-2023-0875 - Wp Meta Seo Plugin

The WP Meta SEO WordPress plugin before 4.5.3 does not properly sanitize and escape inputs into SQL queries, leading to a blind SQL Injection vulnerability that can be exploited by subscriber+ users.

PLUGIN Wp Meta Seo

CVE-2023-0875

HIGH CVSS 8.8 2023-03-20
Open Full Technical Breakdown
Threat Entry Updated 2025-02-26

CVE-2023-0865 - Before 21 Plugin

The WooCommerce Multiple Customer Addresses & Shipping WordPress plugin before 21.7 does not ensure that the address to add/update/retrieve/delete and duplicate belong to the user making the request, or is from a high privilege users, allowing any authenticated users, such as subscriber to add/update/duplicate/delete as well as retrieve addresses of other users.

PLUGIN Before 21

CVE-2023-0865

HIGH CVSS 8.8 2023-03-20
Open Full Technical Breakdown
Threat Entry Updated 2025-02-26

CVE-2023-0340 - Custom Content Shortcode Plugin

The Custom Content Shortcode WordPress plugin through 4.0.2 does not validate one of its shortcode attribute, which could allow users with a contributor role and above to include arbitrary files via a traversal attack. This could also allow them to read non PHP files and retrieve their content. RCE could also be achieved if the attacker manage to upload a malicious image containing PHP code, and then include it via the affected attribute, on a default WP install, authors could easily achieve that given that they have the upload_file capability.

PLUGIN Custom Content Shortcode

CVE-2023-0340

HIGH CVSS 8.8 2023-03-20
Open Full Technical Breakdown
Threat Entry Updated 2025-02-25

CVE-2023-0911 - Shortcodes Ultimate Plugin

The WordPress Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 5.12.8 does not validate the user meta to be retrieved via the user shortcode, allowing any authenticated users such as subscriber to retrieve arbitrary user meta (except the user_pass), such as the user email and activation key by default.

PLUGIN Shortcodes Ultimate

CVE-2023-0911

MEDIUM CVSS 6.5 2023-03-20
Open Full Technical Breakdown
Threat Entry Updated 2024-11-21

CVE-2023-0890 - Shortcodes Ultimate Plugin

The WordPress Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 5.12.8 does not ensure that posts to be displayed via some shortcodes are already public and can be accessed by the user making the request, allowing any authenticated users such as subscriber to view draft, private or even password protected posts. It is also possible to leak the password of protected posts

PLUGIN Shortcodes Ultimate

CVE-2023-0890

MEDIUM CVSS 6.5 2023-03-20
Open Full Technical Breakdown
Threat Entry Updated 2025-02-25

CVE-2023-0937 - Vk All In One Expansion Unit Plugin

The VK All in One Expansion Unit WordPress plugin before 9.87.1.0 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers

PLUGIN Vk All In One Expansion Unit

CVE-2023-0937

MEDIUM CVSS 6.1 2023-03-20
Open Full Technical Breakdown
Scroll to top