# CVEs published 2023-01-02

76 CVEs were published on January 2, 2023: 8 critical, 22 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2022-3860](https://cve.now/CVE-2022-3860.md): Visual Email Designer for WooCommerce \< 1.7.2 - Multiple Author+ SQLi (CVSS 8.8, Visual Email Designer for WooCommerce)
- [CVE-2022-4260](https://cve.now/CVE-2022-4260.md): WP-Ban \< 1.69.1 - Admin+ Stored XSS (CVSS 4.8, WP-Ban)
- [CVE-2022-4237](https://cve.now/CVE-2022-4237.md): Welcart e-Commerce \< 2.8.6 - Subscriber+ PHAR Deserialisation (CVSS 8.8, Welcart e-Commerce)
- [CVE-2022-4372](https://cve.now/CVE-2022-4372.md): Web Invoice \<= 2.1.3 - Authenticated SQLi (CVSS 7.2, Web Invoice)
- [CVE-2022-4329](https://cve.now/CVE-2022-4329.md): Product list Widget for Woocommerce \<= 1.0 - Reflected XSS (CVSS 6.1, Product list Widget for Woocommerce)
- [CVE-2022-4057](https://cve.now/CVE-2022-4057.md): Autoptimize \< 3.1.0 - Sensitive Data Disclosure (CVSS 5.3, Autoptimize)
- [CVE-2022-3911](https://cve.now/CVE-2022-3911.md): iubenda \< 3.3.3 - Subscriber+ Privileges Escalation to Admin (CVSS 8.8, iubenda | All-in-one Compliance for GDPR / CCPA Cookie Cons…)
- [CVE-2022-4256](https://cve.now/CVE-2022-4256.md): All-in-One Addons for Elementor - WidgetKit \< 2.4.4 - Admin+ Stored XSS (CVSS 4.8, All-in-One Addons for Elementor)
- [CVE-2022-4352](https://cve.now/CVE-2022-4352.md): Qe SEO Handyman \<= 1.0 - Admin+ SQLi (CVSS 7.2, Qe SEO Handyman)
- [CVE-2022-4200](https://cve.now/CVE-2022-4200.md): Login with Cognito \<= 1.4.8 - Admin+ Stored XSS (CVSS 4.8, Login with Cognito)
- [CVE-2022-4369](https://cve.now/CVE-2022-4369.md): WP-Lister Lite for Amazon \< 2.4.4 - Reflected XSS (CVSS 6.1, WP-Lister Lite for Amazon)
- [CVE-2022-4099](https://cve.now/CVE-2022-4099.md): Joy Of Text Lite \< 2.3.1 - Unauthenticated SQLi (CVSS 9.8, Joy Of Text Lite)
- [CVE-2022-4298](https://cve.now/CVE-2022-4298.md): Wholesale Market \< 2.2.1 - Unauthenticated Arbitrary File Download (CVSS 9.8, Wholesale Market)
- [CVE-2022-4109](https://cve.now/CVE-2022-4109.md): Wholesale Market for WooCommerce \< 2.0.0 - Admin+ Arbitrary Log Download (CVSS 2.7, Wholesale Market for WooCommerce)
- [CVE-2022-4236](https://cve.now/CVE-2022-4236.md): Welcart e-Commerce \< 2.8.5 - Subscriber+ Arbitrary File Access (CVSS 6.5, Welcart e-Commerce)
- [CVE-2022-4373](https://cve.now/CVE-2022-4373.md): Quote-O-Matic \<= 1.0.5 - Admin+ SQLi (CVSS 7.2, Quote-O-Matic)
- [CVE-2022-4324](https://cve.now/CVE-2022-4324.md): Custom Field Template \< 2.5.8 - Admin+ PHP Object Injection (CVSS 7.2, Custom Field Template)
- [CVE-2022-4114](https://cve.now/CVE-2022-4114.md): Superio - Job Board \< 1.2.33 - Subscriber+ Stored Cross-Site Scripting (CVSS 5.4, Superio)
- [CVE-2022-4417](https://cve.now/CVE-2022-4417.md): WP Cerber \< 9.3.3 - User Enumeration Bypass via Rest API (CVSS 5.3, WP Cerber Security, Anti-spam & Malware Scan)
- [CVE-2022-4381](https://cve.now/CVE-2022-4381.md): Popup Maker \< 1.16.9 - Contributor+ Stored XSS via Subscription Form (CVSS 5.4, Popup Maker)
- [CVE-2022-4362](https://cve.now/CVE-2022-4362.md): Popup Maker \< 1.16.9 - Contributor+ Stored XSS via Shortcode (CVSS 5.4, Popup Maker)
- [CVE-2022-4358](https://cve.now/CVE-2022-4358.md): WP RSS By Publishers \<= 0.1 - Admin+ SQLi (CVSS 7.2, WP RSS By Publishers)
- [CVE-2022-4359](https://cve.now/CVE-2022-4359.md): WP RSS By Publishers \<= 0.1 - Admin+ SQLi (CVSS 7.2, WP RSS By Publishers)
- [CVE-2022-3936](https://cve.now/CVE-2022-3936.md): Team Members \< 5.2.1 - Editor+ Stored XSS (CVSS 4.8, Team Members)
- [CVE-2022-4119](https://cve.now/CVE-2022-4119.md): Image Optimizer, Resizer and CDN \< 6.8.1 - Admin+ Stored XSS (CVSS 4.8, Image Optimizer, Resizer and CDN)
- [CVE-2022-4355](https://cve.now/CVE-2022-4355.md): LetsRecover \< 1.2.0 - Admin+ SQLi (CVSS 7.2, LetsRecover)
- [CVE-2022-3994](https://cve.now/CVE-2022-3994.md): Authenticator \< 1.3.1 - Subscriber+ Denial of Service via Feed Token Disclosure (CVSS 4.3, Authenticator)
- [CVE-2022-4302](https://cve.now/CVE-2022-4302.md): White Label CMS \< 2.5 - Admin+ PHP Object Injection (CVSS 7.2, White Label CMS)
- [CVE-2022-4142](https://cve.now/CVE-2022-4142.md): WordPress Filter Gallery Plugin \< 0.1.6 - Admin+ Stored XSS (CVSS 4.8, WordPress Filter Gallery Plugin)
- [CVE-2022-4356](https://cve.now/CVE-2022-4356.md): LetsRecover \< 1.2.0 - Admin+ SQLi (CVSS 7.2, LetsRecover)
- [CVE-2022-4340](https://cve.now/CVE-2022-4340.md): BookingPress \< 1.0.31 - Unauthenticated IDOR in appointment\_id (CVSS 5.3, BookingPress)
- [CVE-2022-4198](https://cve.now/CVE-2022-4198.md): WP Social Sharing \<= 2.2 - Admin+ Stored XSS (CVSS 4.8, WP Social Sharing)
- [CVE-2022-4049](https://cve.now/CVE-2022-4049.md): WP User \<= 7.0 - Unauthenticated SQLi (CVSS 9.8, WP User)
- [CVE-2022-4360](https://cve.now/CVE-2022-4360.md): WP RSS By Publishers \<= 0.1 - Admin+ SQLi (CVSS 7.2, WP RSS By Publishers)
- [CVE-2022-4140](https://cve.now/CVE-2022-4140.md): Welcart e-Commerce \< 2.8.5 - Unauthenticated Arbitrary File Access (CVSS 7.5, Welcart e-Commerce)
- [CVE-2022-3241](https://cve.now/CVE-2022-3241.md): Build App Online \< 1.0.19 - Unauthenticated SQL Injection (CVSS 9.8, Build App Online)
- [CVE-2022-4357](https://cve.now/CVE-2022-4357.md): LetsRecover \< 1.2.0 - Unauthenticated SQLi (CVSS 9.8, LetsRecover)
- [CVE-2022-4059](https://cve.now/CVE-2022-4059.md): Cryptocurrency Widgets Pack \< 2.0 - Unauthenticated SQLi (CVSS 9.8, Cryptocurrency Widgets Pack)
- [CVE-2022-4370](https://cve.now/CVE-2022-4370.md): Multimedial Images \<= 1.0b - Admin+ SQLi (CVSS 7.2, multimedial images)
- [CVE-2022-4297](https://cve.now/CVE-2022-4297.md): WP AutoComplete Search \<= 1.0.4 - Unauthenticated SQLi (CVSS 9.8, WP AutoComplete Search)
- [CVE-2022-4351](https://cve.now/CVE-2022-4351.md): Qe SEO Handyman \<= 1.0 - Admin+ SQLi (CVSS 7.2, Qe SEO Handyman)
- [CVE-2022-4371](https://cve.now/CVE-2022-4371.md): Web Invoice \<= 2.1.3 - Authenticated SQLi (CVSS 7.2, Web Invoice)
- [CVE-2015-10011](https://cve.now/CVE-2015-10011.md): OpenDNS OpenResolve endpoints.py neutralization for logs (CVSS 4.6, OpenDNS OpenResolve)
- [CVE-2015-10010](https://cve.now/CVE-2015-10010.md): OpenDNS OpenResolve API endpoints.py get cross site scripting (CVSS 3.1, OpenDNS OpenResolve)
- [CVE-2023-22452](https://cve.now/CVE-2023-22452.md): Improper Input Validation in kenny2automate (CVSS 6.5, Kenny2github kenny2automate)
- [CVE-2016-15007](https://cve.now/CVE-2016-15007.md): Centralized-Salesforce-Dev-Framework SOQL SObjectService.cls SObjectService injection (CVSS 5.5, Centralized-Salesforce-Dev-Framework)
- [CVE-2014-125038](https://cve.now/CVE-2014-125038.md): IS\_Projecto2 NewsBean.java sql injection (CVSS 5.5, IS\_Projecto2)
- [CVE-2014-125037](https://cve.now/CVE-2014-125037.md): License to Kill injury.rb sql injection (CVSS 5.5, License to Kill)
- [CVE-2014-125036](https://cve.now/CVE-2014-125036.md): drybjed ansible-ntp main.yml amplification (CVSS 2.6, drybjed ansible-ntp)
- [CVE-2014-125035](https://cve.now/CVE-2014-125035.md): Jobs-Plugin cross site scripting (CVSS 3.5, Jobs-Plugin)
- [CVE-2023-22451](https://cve.now/CVE-2023-22451.md): Weak password requirements in Kiwi TCMS (CVSS 6.5, kiwitcms Kiwi)
- [CVE-2017-20161](https://cve.now/CVE-2017-20161.md): rofl0r MacGeiger ESSID macgeiger.c dump\_wlan\_at injection (CVSS 4.6, rofl0r MacGeiger)
- [CVE-2015-10009](https://cve.now/CVE-2015-10009.md): nterchange code\_caller\_controller.php getContent code injection (CVSS 5.5, nterchange · nonfiction/nterchange)
- [CVE-2015-10008](https://cve.now/CVE-2015-10008.md): 82Flex WEIPDCRM sql injection (CVSS 6.3, 82Flex WEIPDCRM)
- [CVE-2015-10007](https://cve.now/CVE-2015-10007.md): 82Flex WEIPDCRM cross site scripting (CVSS 3.5, 82Flex WEIPDCRM)
- [CVE-2014-125034](https://cve.now/CVE-2014-125034.md): stiiv contact\_app View.php render cross site scripting (CVSS 3.5, stiiv contact\_app)
- [CVE-2019-25093](https://cve.now/CVE-2019-25093.md): dragonexpert Recent Threads on Index Setting hooks.php recentthread\_list\_threads cross site scripting (CVSS 2.4, dragonexpert Recent Threads on Index)
- [CVE-2022-42475](https://cve.now/CVE-2022-42475.md): A heap-based buffer overflow vulnerability \[CWE-122\] in FortiOS SSL-VPN 7.2.0 through 7.2.2, 7.0.0 through 7.0.8, 6.4.0 through 6.4.10, 6.2. (CVSS 9.3, KEV, Fortinet FortiProxy · Fortinet FortiOS)
- [CVE-2016-15006](https://cve.now/CVE-2016-15006.md): enigmaX Scrambling Table main.c getSeed prng seed (CVSS 3.7, enigmaX)
- [CVE-2021-4299](https://cve.now/CVE-2021-4299.md): cronvel string-kit naturalSort.js naturalSort redos (CVSS 4.3, cronvel string-kit · string-kit)
- [CVE-2021-4298](https://cve.now/CVE-2021-4298.md): Hesburgh Libraries of Notre Dame Sipity search\_criteria\_for\_works\_parameter.rb SearchCriteriaForWorksParameter sql injection (CVSS 5.5, Hesburgh Libraries of Notre Dame Sipity)
- [CVE-2014-125033](https://cve.now/CVE-2014-125033.md): rails-cv-app uploaded\_files\_controller.rb path traversal (CVSS 3.5, rails-cv-app)
- [CVE-2014-125032](https://cve.now/CVE-2014-125032.md): porpeeranut go-with-me add.php sql injection (CVSS 5.5, porpeeranut go-with-me)
- [CVE-2014-125031](https://cve.now/CVE-2014-125031.md): kirill2485 TekNet loggedin.php cross site scripting (CVSS 3.5, kirill2485 TekNet)
- [CVE-2019-13768](https://cve.now/CVE-2019-13768.md): Use after free in FileAPI in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to potentially perform a sandbox escape via a cra (no CVSS, Google Chrome)
- [CVE-2021-21200](https://cve.now/CVE-2021-21200.md): Out of bounds read in WebUI Settings in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to perform an out of bounds memory rea (no CVSS, Google Chrome)
- [CVE-2021-30558](https://cve.now/CVE-2021-30558.md): Insufficient policy enforcement in content security policy in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass conten (CVSS 8.8, Google Chrome)
- [CVE-2022-0337](https://cve.now/CVE-2022-0337.md): Inappropriate implementation in File System API in Google Chrome on Windows prior to 97.0.4692.71 allowed a remote attacker to obtain potent (no CVSS, Google Chrome)
- [CVE-2022-0801](https://cve.now/CVE-2022-0801.md): Inappropriate implementation in HTML parser in Google Chrome prior to 99.0.4844.51 allowed a remote attacker to bypass XSS preventions via a (no CVSS, Google Chrome)
- [CVE-2022-2742](https://cve.now/CVE-2022-2742.md): Use after free in Exosphere in Google Chrome on Chrome OS and Lacros prior to 104.0.5112.79 allowed a remote attacker who convinced a user t (CVSS 8.8, Google Chrome)
- [CVE-2022-2743](https://cve.now/CVE-2022-2743.md): Integer overflow in Window Manager in Google Chrome on Chrome OS and Lacros prior to 104.0.5112.79 allowed a remote attacker who convinced a (CVSS 8.8, Google Chrome)
- [CVE-2022-3460](https://cve.now/CVE-2022-3460.md): In affected versions of Octopus Deploy it is possible for certain types of sensitive variables to inadvertently become unmasked when viewed (CVSS 7.5, Octopus Deploy Octopus Server)
- [CVE-2022-3842](https://cve.now/CVE-2022-3842.md): Use after free in Passwords in Google Chrome prior to 105.0.5195.125 allowed a remote attacker who had compromised the renderer process to p (CVSS 7.5, Google Chrome)
- [CVE-2022-3863](https://cve.now/CVE-2022-3863.md): Use after free in Browser History in Google Chrome prior to 100.0.4896.75 allowed a remote attacker to potentially exploit heap corruption v (CVSS 6.5, Google Chrome)
- [CVE-2022-4025](https://cve.now/CVE-2022-4025.md): Inappropriate implementation in Paint in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to leak cross-origin data outside an (CVSS 4.3, Google Chrome)
- [CVE-2022-48197](https://cve.now/CVE-2022-48197.md): Reflected cross-site scripting (XSS) exists in Sandbox examples in the YUI2 repository. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-01-02
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.