CVE-2023-47xxx records

Browse official CVE Program records with vulnerability descriptions, affected products, CVSS scores and source references. Browse by the year and numeric range in each CVE ID; publication and update dates appear on each record.

637 records · Page 1 of 7

• CVE-2023-47997: An issue discovered in BitmapAccess.cpp::FreeImage_AllocateBitmap in FreeImage 3.18.0 leads to an infinite loop and allows attackers to cause a denial of service. 6.5 Medium

  An issue discovered in BitmapAccess.cpp::FreeImage_AllocateBitmap in FreeImage 3.18.0 leads to an infinite loop and allows attackers to cause a denial of service.

  Updated 2025-11-04
• CVE-2023-47996: An integer overflow vulnerability in Exif.cpp::jpeg_read_exif_dir in FreeImage 3.18.0 allows attackers to obtain information and cause a denial of service. 6.5 Medium

  An integer overflow vulnerability in Exif.cpp::jpeg_read_exif_dir in FreeImage 3.18.0 allows attackers to obtain information and cause a denial of service.

  Updated 2025-05-14
• CVE-2023-47995: Memory Allocation with Excessive Size Value discovered in BitmapAccess.cpp::FreeImage_AllocateBitmap in FreeImage 3.18.0 allows attackers to cause a denial of service. 6.5 Medium

  Memory Allocation with Excessive Size Value discovered in BitmapAccess.cpp::FreeImage_AllocateBitmap in FreeImage 3.18.0 allows attackers to cause a denial of service.

  Updated 2025-11-04
• CVE-2023-47994: An integer overflow vulnerability in LoadPixelDataRLE4 function in PluginBMP.cpp in Freeimage 3.18.0 allows attackers to obtain sensitive information, cause a denial of service and 8.8 High

  An integer overflow vulnerability in LoadPixelDataRLE4 function in PluginBMP.cpp in Freeimage 3.18.0 allows attackers to obtain sensitive information, cause a denial of service and/or run arbitrary code.

  Updated 2025-06-03
• CVE-2023-47993: A Buffer out-of-bound read vulnerability in Exif.cpp::ReadInt32 in FreeImage 3.18.0 allows attackers to cause a denial-of-service. 6.5 Medium

  A Buffer out-of-bound read vulnerability in Exif.cpp::ReadInt32 in FreeImage 3.18.0 allows attackers to cause a denial-of-service.

  Updated 2025-06-20
• CVE-2023-47992: An integer overflow vulnerability in FreeImageIO.cpp::_MemoryReadProc in FreeImage 3.18.0 allows attackers to obtain sensitive information, cause a denial-of-service attacks and/or 8.8 High

  An integer overflow vulnerability in FreeImageIO.cpp::_MemoryReadProc in FreeImage 3.18.0 allows attackers to obtain sensitive information, cause a denial-of-service attacks and/or run arbitrary code.

  Updated 2025-06-17
• CVE-2023-47990: SQL Injection vulnerability in components/table_manager/html/edit_admin_table.php in CuppaCMS V1.0 allows attackers to run arbitrary SQL commands via the table parameter. 9.8 Critical

  SQL Injection vulnerability in components/table_manager/html/edit_admin_table.php in CuppaCMS V1.0 allows attackers to run arbitrary SQL commands via the table parameter.

  Updated 2024-09-16
• CVE-2023-47890: pyLoad 0.5.0 is vulnerable to Unrestricted File Upload. 8.8 High

  pyLoad 0.5.0 is vulnerable to Unrestricted File Upload.

  Updated 2026-07-09
• CVE-2023-47889: The Android application BINHDRM26 com.bdrm.superreboot 1.0.3, exposes several critical actions through its exported broadcast receivers. These exposed actions can allow any app on 7.8 High

  The Android application BINHDRM26 com.bdrm.superreboot 1.0.3, exposes several critical actions through its exported broadcast receivers. These exposed actions can allow any app on the device to send unauthorized broadcasts, leading to unintended consequences. The vulnerability is particularly concerning because these actions include powering off, system reboot & entering recovery mode.

  Updated 2025-06-20
• CVE-2023-47883: The com.altamirano.fabricio.tvbrowser TV browser application through 4.5.1 for Android is vulnerable to JavaScript code execution via an explicit intent due to an exposed MainActiv Unscored

  The com.altamirano.fabricio.tvbrowser TV browser application through 4.5.1 for Android is vulnerable to JavaScript code execution via an explicit intent due to an exposed MainActivity.

  Updated 2024-08-02
• CVE-2023-47882: The Kami Vision YI IoT com.yunyi.smartcamera application through 4.1.9_20231127 for Android allows a remote attacker to execute arbitrary JavaScript code via an implicit intent to Unscored

  The Kami Vision YI IoT com.yunyi.smartcamera application through 4.1.9_20231127 for Android allows a remote attacker to execute arbitrary JavaScript code via an implicit intent to the com.ants360.yicamera.activity.WebViewActivity component.

  Updated 2024-08-02
• CVE-2023-47877: WordPress Perfmatters Plugin < 2.2.0 is vulnerable to Cross Site Scripting (XSS) 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Perfmatters allows Stored XSS.This issue affects Perfmatters: from n/a before 2.2.0.

  Updated 2026-04-28
• CVE-2023-47876: WordPress Perfmatters Plugin <= 2.1.6 is vulnerable to Cross Site Scripting (XSS) 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Perfmatters allows Reflected XSS.This issue affects Perfmatters: from n/a through 2.1.6.

  Updated 2026-04-28
• CVE-2023-47875: WordPress Perfmatters Plugin <= 2.1.6 is vulnerable to Cross Site Request Forgery (CSRF) 5.4 Medium

  Cross-Site Request Forgery (CSRF) vulnerability in Perfmatters allows Cross Site Request Forgery.This issue affects Perfmatters: from n/a through 2.1.6.

  Updated 2026-04-28
• CVE-2023-47874: WordPress Perfmatters Plugin <= 2.1.6 is vulnerable to Broken Access Control 5.4 Medium

  Missing Authorization vulnerability in Perfmatters.This issue affects Perfmatters: from n/a through 2.1.6.

  Updated 2026-04-28
• CVE-2023-47873: WordPress WP Child Theme Generator plugin <= 1.0.9 - Arbitrary File Upload vulnerability 9.1 Critical

  Unrestricted Upload of File with Dangerous Type vulnerability in WEN Solutions WP Child Theme Generator.This issue affects WP Child Theme Generator: from n/a through 1.0.9.

  Updated 2026-04-28
• CVE-2023-47872: WordPress wpForo Forum Plugin <= 2.2.3 is vulnerable to Cross Site Scripting (XSS) 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gVectors Team wpForo Forum allows Stored XSS.This issue affects wpForo Forum: from n/a through 2.2.3.

  Updated 2026-04-28
• CVE-2023-47871: WordPress Contact Form to Any API plugin <= 1.1.6 - Broken Access Control vulnerability 4.3 Medium

  Missing Authorization vulnerability in IT Path Solutions Contact Form to Any API allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Form to Any API: from n/a through 1.1.6.

  Updated 2026-04-28
• CVE-2023-47870: WordPress wpForo Forum Plugin <= 2.2.6 is vulnerable to Broken Access Control and Cross Site Request Forgery (CSRF) 7.1 High

  Cross-Site Request Forgery (CSRF), Missing Authorization vulnerability in gVectors Team wpForo Forum wpforo allows Cross Site Request Forgery, Accessing Functionality Not Properly Constrained by ACLs leading to forced all users log out.This issue affects wpForo Forum: from n/a through 2.2.6.

  Updated 2026-04-28
• CVE-2023-47869: WordPress wpForo plugin <= 2.2.5 - Broken Access Control + CSRF vulnerability 4.3 Medium

  Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in gVectors Team wpForo Forum allows Code Injection.This issue affects wpForo Forum: from n/a through 2.2.5.

  Updated 2026-04-28
• CVE-2023-47868: WordPress wpForo plugin <= 2.2.3 - Privilege Escalation vulnerability 7.3 High

  Improper Privilege Management vulnerability in wpForo wpForo Forum allows Privilege Escalation.This issue affects wpForo Forum: from n/a through 2.2.3.

  Updated 2026-04-28
• CVE-2023-47867: MachineSense FeverWarn Improper Access Control 8.8 High

  MachineSense FeverWarn devices are configured as Wi-Fi hosts in a way that attackers within range could connect to the device's web services and compromise the device.

  Updated 2024-08-02
• CVE-2023-47865: Username and Icon override can be used by members when Hardened Mode is enabled 4.3 Medium

  Mattermost fails to check if hardened mode is enabled when overriding the username and/or the icon when posting a post. If settings allowed integrations to override the username and profile picture when posting, a member could also override the username and icon when making a post even if the Hardened Mode setting was enabled

  Updated 2024-08-02
• CVE-2023-47862: A local file inclusion vulnerability exists in the getLanguageFromBrowser functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP request can lead to ar 9.8 Critical

  A local file inclusion vulnerability exists in the getLanguageFromBrowser functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can send a series of HTTP requests to trigger this vulnerability.

  Updated 2025-11-04
• CVE-2023-47861: A cross-site scripting (xss) vulnerability exists in the channelBody.php user name functionality of WWBN AVideo 11.6 and dev master commit 15fed957fb. A specially crafted HTTP requ 9.0 Critical

  A cross-site scripting (xss) vulnerability exists in the channelBody.php user name functionality of WWBN AVideo 11.6 and dev master commit 15fed957fb. A specially crafted HTTP request can lead to arbitrary Javascript execution. An attacker can get a user to visit a webpage to trigger this vulnerability.

  Updated 2025-11-04
• CVE-2023-47859: Improper access control for some Intel(R) Wireless Bluetooth products for Windows before version 23.20 may allow an authenticated user to potentially enable denial of service via l 5.5 Medium

  Improper access control for some Intel(R) Wireless Bluetooth products for Windows before version 23.20 may allow an authenticated user to potentially enable denial of service via local access.

  Updated 2024-08-02
• CVE-2023-47858: Details of archived public channels are leaked to members of another team 4.3 Medium

  Mattermost fails to properly verify the permissions needed for viewing archived public channels,  allowing a member of one team to get details about the archived public channels of another team via the GET /api/v4/teams/<team-id>/channels/deleted endpoint.

  Updated 2025-06-17
• CVE-2023-47857: multimedia camera has a UAF vulnerability 4.0 Medium

  in OpenHarmony v3.2.2 and prior versions allow a local attacker cause multimedia camera crash through modify a released pointer.

  Updated 2025-06-03
• CVE-2023-47856: A stack-based buffer overflow vulnerability exists in the boa set_RadvdPrefixParam functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially crafted series of network reques 7.2 High

  A stack-based buffer overflow vulnerability exists in the boa set_RadvdPrefixParam functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially crafted series of network requests can lead to remote code execution. An attacker can send a sequence of requests to trigger this vulnerability.

  Updated 2025-11-04
• CVE-2023-47855: Improper input validation in some Intel(R) TDX module software before version 1.5.05.46.698 may allow a privileged user to potentially enable escalation of privilege via local acce 6.0 Medium

  Improper input validation in some Intel(R) TDX module software before version 1.5.05.46.698 may allow a privileged user to potentially enable escalation of privilege via local access.

  Updated 2025-02-13
• CVE-2023-47854: WordPress Parallax Image Plugin <= 1.7.1 is vulnerable to Cross Site Scripting (XSS) 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Howard Ehrenberg Parallax Image allows Stored XSS.This issue affects Parallax Image: from n/a through 1.7.1.

  Updated 2026-04-28
• CVE-2023-47853: WordPress myCred Plugin <= 2.6.1 is vulnerable to Cross Site Scripting (XSS) 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in myCred myCred – Points, Rewards, Gamification, Ranks, Badges & Loyalty Plugin allows Stored XSS.This issue affects myCred – Points, Rewards, Gamification, Ranks, Badges & Loyalty Plugin: from n/a through 2.6.1.

  Updated 2026-04-28
• CVE-2023-47852: WordPress Link Whisper Free Plugin <= 0.6.5 is vulnerable to SQL Injection 8.5 High

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Link Whisper Link Whisper Free.This issue affects Link Whisper Free: from n/a through 0.6.5.

  Updated 2026-04-28
• CVE-2023-47851: WordPress Bootstrap Shortcodes Ultimate Plugin <= 4.3.1 is vulnerable to Cross Site Scripting (XSS) 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Akhtarujjaman Shuvo Bootstrap Shortcodes Ultimate allows Stored XSS.This issue affects Bootstrap Shortcodes Ultimate: from n/a through 4.3.1.

  Updated 2026-04-28
• CVE-2023-47850: WordPress Community by PeepSo Plugin <= 6.2.2.0 is vulnerable to Cross Site Scripting (XSS) 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PeepSo Community by PeepSo – Social Network, Membership, Registration, User Profiles allows Stored XSS.This issue affects Community by PeepSo – Social Network, Membership, Registration, User Profiles: from n/a through 6.2.2.0.

  Updated 2026-04-28
• CVE-2023-47849: WordPress BlossomThemes Email Newsletter plugin <= 2.2.4 - Broken Access Control vulnerability 4.3 Medium

  Missing Authorization vulnerability in Blossom Themes BlossomThemes Email Newsletter blossomthemes-email-newsletter allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BlossomThemes Email Newsletter: from n/a through <= 2.2.4.

  Updated 2026-04-29
• CVE-2023-47848: WordPress Tainacan Plugin <= 0.20.4 is vulnerable to Cross Site Scripting (XSS) 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tainacan.Org Tainacan allows Reflected XSS.This issue affects Tainacan: from n/a through 0.20.4.

  Updated 2026-04-28
• CVE-2023-47847: WordPress PayTR Taksit Tablosu plugin <= 1.3.1 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in PayTR Ödeme ve Elektronik Para Kuruluşu A.Ş. PayTR Taksit Tablosu allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PayTR Taksit Tablosu: from n/a through 1.3.1.

  Updated 2026-04-28
• CVE-2023-47846: WordPress WP Githuber MD plugin <= 1.16.2 - Arbitrary File Upload vulnerability 9.1 Critical

  Unrestricted Upload of File with Dangerous Type vulnerability in Terry Lin WP Githuber MD.This issue affects WP Githuber MD: from n/a through 1.16.2.

  Updated 2026-04-28
• CVE-2023-47845: WordPress Grab & Save plugin <= 1.0.4 - Cross-Site Request Forgery (CSRF) vulnerability 4.3 Medium

  Cross-Site Request Forgery (CSRF) vulnerability in Lim Kai Yang Grab & Save.This issue affects Grab & Save: from n/a through 1.0.4.

  Updated 2026-04-28
• CVE-2023-47844: WordPress Grab & Save Plugin <= 1.0.4 is vulnerable to Cross Site Scripting (XSS) 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Lim Kai Yang Grab & Save allows Reflected XSS.This issue affects Grab & Save: from n/a through 1.0.4.

  Updated 2026-04-28
• CVE-2023-47843: WordPress CataBlog Plugin <= 1.7.0 is vulnerable to Arbitrary File Deletion 7.6 High

  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Zachary Segal CataBlog.This issue affects CataBlog: from n/a through 1.7.0.

  Updated 2026-04-28
• CVE-2023-47842: WordPress CataBlog plugin <= 1.7.0 - Arbitrary File Upload vulnerability 9.1 Critical

  Unrestricted Upload of File with Dangerous Type vulnerability in Zachary Segal CataBlog.This issue affects CataBlog: from n/a through 1.7.0.

  Updated 2026-04-28
• CVE-2023-47841: WordPress Analytify plugin <= 5.1.1 - Broken Access Control vulnerability 4.3 Medium

  Missing Authorization vulnerability in Analytify Analytify allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Analytify: from n/a through 5.1.1.

  Updated 2026-04-28
• CVE-2023-47840: WordPress Qode Essential Addons Plugin <= 1.5.2 is vulnerable to Remote Code Execution (RCE) 9.9 Critical

  Improper Control of Generation of Code ('Code Injection') vulnerability in Qode Interactive Qode Essential Addons.This issue affects Qode Essential Addons: from n/a through 1.5.2.

  Updated 2026-04-28
• CVE-2023-47839: WordPress eCommerce Product Catalog Plugin <= 3.3.26 is vulnerable to Cross Site Scripting (XSS) 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in impleCode eCommerce Product Catalog Plugin for WordPress plugin <= 3.3.26 versions.

  Updated 2026-04-28
• CVE-2023-47838: WordPress Conditional Fields for Contact Form 7 plugin <= 2.4.1 - Broken Access Control vulnerability 4.3 Medium

  Missing Authorization vulnerability in Jules Colle Conditional Fields for Contact Form 7 cf7-conditional-fields allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Conditional Fields for Contact Form 7: from n/a through <= 2.4.1.

  Updated 2026-04-29
• CVE-2023-47837: WordPress ARMember plugin <= 4.0.10 - Membership Plan Bypass vulnerability 8.3 High

  Improper Privilege Management vulnerability in Repute Infosystems ARMember allows Privilege Escalation.This issue affects ARMember: from n/a through 4.0.10.

  Updated 2026-04-28
• CVE-2023-47836: WordPress WP Meta and Date Remover plugin <= 2.3.0 - Broken Access Control vulnerability 5.4 Medium

  Missing Authorization vulnerability in prasadkirpekar WP Meta and Date Remover wp-meta-and-date-remover allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Meta and Date Remover: from n/a through <= 2.3.0.

  Updated 2026-04-29
• CVE-2023-47835: WordPress ARI Stream Quiz Plugin <= 1.2.32 is vulnerable to Cross Site Scripting (XSS) 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ARI Soft ARI Stream Quiz – WordPress Quizzes Builder plugin <= 1.2.32 versions.

  Updated 2026-04-28
• CVE-2023-47834: WordPress Quiz And Survey Master Plugin <= 8.1.13 is vulnerable to Cross Site Scripting (XSS) 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ExpressTech Quiz And Survey Master plugin <= 8.1.13 versions.

  Updated 2026-04-28
• CVE-2023-47833: WordPress Theater for WordPress Plugin <= 0.18.3 is vulnerable to Cross Site Scripting (XSS) 5.9 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeroen Schmit Theater for WordPress plugin <= 0.18.3 versions.

  Updated 2026-04-28
• CVE-2023-47832: WordPress SearchIQ plugin <= 4.4 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in SearchIQ SearchIQ searchiq allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SearchIQ: from n/a through <= 4.4.

  Updated 2026-04-29
• CVE-2023-47831: WordPress DrawIt (draw.io) Plugin <= 1.1.3 is vulnerable to Cross Site Scripting (XSS) 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in assorted[chips] DrawIt (draw.Io) plugin <= 1.1.3 versions.

  Updated 2026-04-28
• CVE-2023-47830: WordPress Live Preview for Contact Form 7 plugin <= 1.2.0 - Broken Access Control vulnerability 5.4 Medium

  Missing Authorization vulnerability in Addons for Contact Form 7 Live Preview for Contact Form 7 allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Live Preview for Contact Form 7: from n/a through 1.2.0.

  Updated 2026-04-28
• CVE-2023-47829: WordPress Quick Call Button Plugin <= 1.2.9 is vulnerable to Cross Site Scripting (XSS) 5.9 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Codez Quick Call Button plugin <= 1.2.9 versions.

  Updated 2026-04-28
• CVE-2023-47828: WordPress wpMandrill plugin <= 1.33 - Broken Access Control vulnerability 4.3 Medium

  Missing Authorization vulnerability in Mandrill wpMandrill.This issue affects wpMandrill: from n/a through 1.33.

  Updated 2026-04-28
• CVE-2023-47827: WordPress Events Addon for Elementor Plugin <= 2.1.3 is vulnerable to Broken Access Control 6.5 Medium

  Incorrect Authorization vulnerability in NicheAddons Events Addon for Elementor allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Events Addon for Elementor: from n/a through 2.1.3.

  Updated 2026-04-28
• CVE-2023-47826: WordPress Restaurant & Cafe Addon for Elementor plugin <= 1.5.3 - Broken Access Control vulnerability 6.5 Medium

  Missing Authorization vulnerability in NicheAddons Restaurant & Cafe Addon for Elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Restaurant & Cafe Addon for Elementor: from n/a through 1.5.3.

  Updated 2026-04-28
• CVE-2023-47825: WordPress WP EXtra Plugin <= 6.4 is vulnerable to Cross Site Request Forgery (CSRF) 4.3 Medium

  Cross-Site Request Forgery (CSRF) vulnerability in TienCOP WP EXtra plugin <= 6.4 versions.

  Updated 2026-04-28
• CVE-2023-47824: WordPress Legal Pages Plugin <= 1.3.8 is vulnerable to Cross Site Request Forgery (CSRF) 5.4 Medium

  Cross-Site Request Forgery (CSRF) vulnerability in wpWax Legal Pages – Privacy Policy, Terms & Conditions, GDPR, CCPA, and Cookie Notice Generator plugin <= 1.3.8 versions.

  Updated 2026-04-28
• CVE-2023-47823: WordPress FormCraft – Contact Form Builder for WordPress plugin <= 1.2.7 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in nCrafts FormCraft allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FormCraft: from n/a through 1.2.7.

  Updated 2026-04-28
• CVE-2023-47822: WordPress MP3 Audio Player for Music, Radio & Podcast by Sonaar plugin <= 4.10 - Broken Access Control vulnerability 5.4 Medium

  Missing Authorization vulnerability in Sonaar Music MP3 Audio Player for Music, Radio & Podcast by Sonaar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MP3 Audio Player for Music, Radio & Podcast by Sonaar: from n/a through 4.10.

  Updated 2026-04-28
• CVE-2023-47821: WordPress Email Encoder Bundle Plugin <= 2.1.8 is vulnerable to Cross Site Scripting (XSS) 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jannis Thuemmig Email Encoder plugin <= 2.1.8 versions.

  Updated 2026-04-28
• CVE-2023-47820: WordPress WP Like Button plugin <= 1.7.0 - Broken Access Control vulnerability 4.3 Medium

  Missing Authorization vulnerability in CRUDLab WP Like Button allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Like Button: from n/a through 1.7.0.

  Updated 2026-04-28
• CVE-2023-47819: WordPress Easy Call Now by ThikShare Plugin <= 1.1.0 is vulnerable to Cross Site Request Forgery (CSRF) 4.3 Medium

  Cross-Site Request Forgery (CSRF) vulnerability in Dang Ngoc Binh Easy Call Now by ThikShare plugin <= 1.1.0 versions.

  Updated 2026-04-28
• CVE-2023-47818: WordPress LWS Hide Login plugin <= 2.1.8 - Secret Login Page Location Disclosure on Multisites vulnerability 3.7 Low

  Exposure of Sensitive Information to an Unauthorized Actor vulnerability in LWS LWS Hide Login allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects LWS Hide Login: from n/a through 2.1.8.

  Updated 2026-04-28
• CVE-2023-47817: WordPress Daily Prayer Time Plugin <= 2023.10.13 is vulnerable to Cross Site Scripting (XSS) 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mmrs151 Daily Prayer Time plugin <= 2023.10.13 versions.

  Updated 2026-04-28
• CVE-2023-47816: WordPress Charitable Plugin <= 1.7.0.13 is vulnerable to Cross Site Scripting (XSS) 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Charitable Donations & Fundraising Team Donation Forms by Charitable plugin <= 1.7.0.13 versions.

  Updated 2026-04-28
• CVE-2023-47815: WordPress BP Profile Shortcodes Extra Plugin <= 2.5.2 is vulnerable to Cross Site Scripting (XSS) 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Venutius BP Profile Shortcodes Extra plugin <= 2.5.2 versions.

  Updated 2026-04-28
• CVE-2023-47814: WordPress BMI Calculator Plugin Plugin <= 1.0.3 is vulnerable to Cross Site Scripting (XSS) 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Waterloo Plugins BMI Calculator Plugin plugin <= 1.0.3 versions.

  Updated 2026-04-28
• CVE-2023-47813: WordPress Better RSS Widget Plugin <= 2.8.1 is vulnerable to Cross Site Scripting (XSS) 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in grandslambert Better RSS Widget plugin <= 2.8.1 versions.

  Updated 2026-04-28
• CVE-2023-47812: WordPress Bamboo Columns Plugin <= 1.6.1 is vulnerable to Cross Site Scripting (XSS) 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bamboo Mcr Bamboo Columns plugin <= 1.6.1 versions.

  Updated 2026-04-28
• CVE-2023-47811: WordPress Anywhere Flash Embed Plugin <= 1.0.5 is vulnerable to Cross Site Scripting (XSS) 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Suresh KUMAR Mukhiya Anywhere Flash Embed plugin <= 1.0.5 versions.

  Updated 2026-04-28
• CVE-2023-47810: WordPress Ajax Domain Checker Plugin <= 1.3.0 is vulnerable to Cross Site Scripting (XSS) 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Asdqwe Dev Ajax Domain Checker plugin <= 1.3.0 versions.

  Updated 2026-04-28
• CVE-2023-47809: WordPress Accordion Plugin <= 2.6 is vulnerable to Cross Site Scripting (XSS) 5.9 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themepoints Accordion plugin <= 2.6 versions.

  Updated 2026-04-28
• CVE-2023-47808: WordPress Add Widgets to Page Plugin <= 1.3.2 is vulnerable to Cross Site Scripting (XSS) 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Christina Uechi Add Widgets to Page plugin <= 1.3.2 versions.

  Updated 2026-04-28
• CVE-2023-47807: WordPress 10WebAnalytics plugin <= 1.2.12 - Broken Access Control vulnerability 4.3 Medium

  Missing Authorization vulnerability in 10Web 10WebAnalytics wd-google-analytics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects 10WebAnalytics: from n/a through <= 1.2.12.

  Updated 2026-04-29
• CVE-2023-47806: WordPress Disable User Login Plugin <= 1.3.7 is vulnerable to Cross Site Request Forgery (CSRF) 5.4 Medium

  Cross-Site Request Forgery (CSRF) vulnerability in Saint Systems Disable User Login.This issue affects Disable User Login: from n/a through 1.3.7.

  Updated 2026-04-28
• CVE-2023-47805: WordPress WPCafe plugin <= 2.2.22 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in Arraytics WPCafe wp-cafe allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPCafe: from n/a through <= 2.2.22.

  Updated 2026-04-29
• CVE-2023-47804: Apache OpenOffice: Macro URL arbitrary script execution Unscored

  Apache OpenOffice documents can contain links that call internal macros with arbitrary arguments. Several URI Schemes are defined for this purpose. Links can be activated by clicks, or by automatic document events. The execution of such links must be subject to user approval. In the affected versions of OpenOffice, approval for certain links is not requested; when activated, such links could th

  Updated 2025-02-13
• CVE-2023-47803: A vulnerability regarding improper limitation of a pathname to a restricted directory ('Path Traversal') is found in the Language Settings functionality. This allows remote attacke 5.3 Medium

  A vulnerability regarding improper limitation of a pathname to a restricted directory ('Path Traversal') is found in the Language Settings functionality. This allows remote attackers to read specific files containing non-sensitive information via unspecified vectors. The following models with Synology Camera Firmware versions before 1.0.7-0298 may be affected: BC500 and TC500.

  Updated 2024-08-02
• CVE-2023-47802: A vulnerability regarding improper neutralization of special elements used in an OS command ('OS Command Injection') is found in the IP block functionality. This allows remote auth 7.2 High

  A vulnerability regarding improper neutralization of special elements used in an OS command ('OS Command Injection') is found in the IP block functionality. This allows remote authenticated users with administrator privileges to execute arbitrary commands via unspecified vectors. The following models with Synology Camera Firmware versions before 1.0.7-0298 may be affected: BC500 and TC500.

  Updated 2024-08-02
• CVE-2023-47801: An issue was discovered in Click Studios Passwordstate before 9811. Existing users (Security Administrators) could use the System Wide API Key to read or delete private password re Unscored

  An issue was discovered in Click Studios Passwordstate before 9811. Existing users (Security Administrators) could use the System Wide API Key to read or delete private password records when specifically used with the PasswordHistory API endpoint. It is also possible to use the Copy/Move Password Record API Key to Copy/Move private password records.

  Updated 2024-09-03
• CVE-2023-47800: Natus NeuroWorks and SleepWorks before 8.4 GMA3 utilize a default password of xltek for the Microsoft SQL Server service sa account, allowing a threat actor to perform remote code Unscored

  Natus NeuroWorks and SleepWorks before 8.4 GMA3 utilize a default password of xltek for the Microsoft SQL Server service sa account, allowing a threat actor to perform remote code execution, data exfiltration, or other nefarious actions such as tampering with data or destroying/disrupting MSSQL services.

  Updated 2024-08-02
• CVE-2023-47799: Mahara before 22.10.4 and 23.x before 23.04.4 allows information disclosure if the experimental HTML bulk export is used via the administration interface or via the CLI, and the re 7.5 High

  Mahara before 22.10.4 and 23.x before 23.04.4 allows information disclosure if the experimental HTML bulk export is used via the administration interface or via the CLI, and the resulting export files are given to the account holders. They may contain images of other account holders because the cache is not cleared after the files of one account are exported.

  Updated 2025-08-25
• CVE-2023-47798: Account lockout in Liferay Portal 7.2.0 through 7.3.0, and older unsupported versions, and Liferay DXP 7.2 before fix pack 5, and older unsupported versions does not invalidate exi 5.4 Medium

  Account lockout in Liferay Portal 7.2.0 through 7.3.0, and older unsupported versions, and Liferay DXP 7.2 before fix pack 5, and older unsupported versions does not invalidate existing user sessions, which allows remote authenticated users to remain authenticated after an account has been locked.

  Updated 2025-05-15
• CVE-2023-47797: Reflected cross-site scripting (XSS) vulnerability on a content page’s edit page in Liferay Portal 7.4.3.94 through 7.4.3.95 allows remote attackers to inject arbitrary web script 9.6 Critical

  Reflected cross-site scripting (XSS) vulnerability on a content page’s edit page in Liferay Portal 7.4.3.94 through 7.4.3.95 allows remote attackers to inject arbitrary web script or HTML via the `p_l_back_url_title` parameter.

  Updated 2024-08-29
• CVE-2023-47795: Stored cross-site scripting (XSS) vulnerability in the Document and Media widget in Liferay Portal 7.4.3.18 through 7.4.3.101, and Liferay DXP 2023.Q3 before patch 6, and 7.4 updat 9.0 Critical

  Stored cross-site scripting (XSS) vulnerability in the Document and Media widget in Liferay Portal 7.4.3.18 through 7.4.3.101, and Liferay DXP 2023.Q3 before patch 6, and 7.4 update 18 through 92 allows remote authenticated users to inject arbitrary web script or HTML via a crafted payload injected into a document's “Title” text field.

  Updated 2024-08-02
• CVE-2023-47793: WordPress Acme Fix Images plugin <= 1.0.0 - Broken Access Control vulnerability 4.3 Medium

  Missing Authorization vulnerability in Acme Themes Acme Fix Images acme-fix-images allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Acme Fix Images: from n/a through <= 1.0.0.

  Updated 2026-04-29
• CVE-2023-47792: WordPress Big File Uploads Plugin <= 2.1.1 is vulnerable to Cross Site Request Forgery (CSRF) 4.3 Medium

  Cross-Site Request Forgery (CSRF) vulnerability in Infinite Uploads Big File Uploads – Increase Maximum File Upload Size plugin <= 2.1.1 versions.

  Updated 2026-04-28
• CVE-2023-47791: WordPress Leadster Plugin <= 1.1.2 is vulnerable to Cross Site Request Forgery (CSRF) 4.3 Medium

  Cross-Site Request Forgery (CSRF) vulnerability in Leadster plugin <= 1.1.2 versions.

  Updated 2026-04-28
• CVE-2023-47790: WordPress Pz-LinkCard Plugin <= 2.4.8 is vulnerable to Cross Site Request Forgery (CSRF) 7.1 High

  Cross-Site Request Forgery (CSRF) leading to Cross-Site Scripting (XSS) vulnerability in Poporon Pz-LinkCard plugin <= 2.4.8 versions.

  Updated 2026-04-28
• CVE-2023-47789: WordPress WooCommerce Canada Post Shipping Plugin <= 2.8.3 is vulnerable to Cross Site Request Forgery (CSRF) 4.3 Medium

  Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce Canada Post Shipping Method.This issue affects Canada Post Shipping Method: from n/a through 2.8.3.

  Updated 2026-04-28
• CVE-2023-47788: WordPress Jetpack plugin < 12.7 - Contributor+ Broken Access Control vulnerability 4.3 Medium

  Missing Authorization vulnerability in Automattic Jetpack.This issue affects Jetpack: from n/a before 12.7.

  Updated 2026-04-28
• CVE-2023-47787: WordPress WooCommerce Bookings Plugin <= 2.0.3 is vulnerable to Cross Site Request Forgery (CSRF) 4.3 Medium

  Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce WooCommerce Bookings.This issue affects WooCommerce Bookings: from n/a through 2.0.3.

  Updated 2026-04-28
• CVE-2023-47786: WordPress LayerSlider Plugin <= 7.7.9 is vulnerable to Cross Site Scripting (XSS) 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LayerSlider plugin <= 7.7.9 versions.

  Updated 2026-04-28
• CVE-2023-47785: WordPress LayerSlider Plugin <= 7.7.9 is vulnerable to Cross Site Request Forgery (CSRF) 7.1 High

  Cross-Site Request Forgery (CSRF) vulnerability in LayerSlider plugin <= 7.7.9 versions.

  Updated 2026-04-28
• CVE-2023-47784: WordPress Slider Revolution Plugin <= 6.6.15 is vulnerable to Arbitrary File Upload 8.4 High

  Unrestricted Upload of File with Dangerous Type vulnerability in ThemePunch OHG Slider Revolution.This issue affects Slider Revolution: from n/a through 6.6.15.

  Updated 2026-04-28
• CVE-2023-47783: WordPress Thrive Theme Builder theme < 3.24.0 - Multiple Authenticated Broken Access Control vulnerability 8.3 High

  Missing Authorization vulnerability in Thrive Themes Thrive Theme Builder.This issue affects Thrive Theme Builder: from n/a before 3.24.0.

  Updated 2026-04-28

Search a CVE ID or check dependency files →