# CVEs published 2023-04-23

26 CVEs were published on April 23, 2023: 1 critical, 3 high. Days are UTC.

- [CVE-2023-23753](https://cve.now/CVE-2023-23753.md): Extension - vi-solutions - Visforms Base Package for Joomla 3 (CVSS 9.8, vi-solutions Visforms Base Package for Joomla)
- [CVE-2023-2246](https://cve.now/CVE-2023-2246.md): SourceCodester Online Pizza Ordering System unrestricted upload (CVSS 6.3, SourceCodester Online Pizza Ordering System)
- [CVE-2023-22686](https://cve.now/CVE-2023-22686.md): WordPress Nice PayPal Button Lite Plugin \<= 1.3.5 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, TriniTronic Nice PayPal Button Lite)
- [CVE-2023-23879](https://cve.now/CVE-2023-23879.md): WordPress PHP Execution Plugin \<= 1.0.0 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Nicolas Zeh PHP Execution)
- [CVE-2022-45080](https://cve.now/CVE-2022-45080.md): WordPress Add Multiple Marker Plugin \<= 1.2 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, KrishaWeb Add Multiple Marker)
- [CVE-2022-45074](https://cve.now/CVE-2022-45074.md): WordPress Activity Reactions For Buddypress Plugin \<= 1.0.22 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Paramveer Singh for Arete IT Private Limited Activity React…)
- [CVE-2023-27614](https://cve.now/CVE-2023-27614.md): WordPress Motor Racing League Plugin \<= 1.9.9 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Ian Haycox Motor Racing League)
- [CVE-2023-27425](https://cve.now/CVE-2023-27425.md): WordPress Electric Studio Client Login Plugin \<= 0.8.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, James Irving-Swift Electric Studio Client Login)
- [CVE-2023-25451](https://cve.now/CVE-2023-25451.md): WordPress CPO Content Types Plugin \<= 1.1.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, WPChill CPO Content Types)
- [CVE-2023-23806](https://cve.now/CVE-2023-23806.md): WordPress WordPress Custom Settings Plugin \<= 1.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Davinder Singh Custom Settings)
- [CVE-2023-23816](https://cve.now/CVE-2023-23816.md): WordPress Sitemap Index Plugin \<= 1.2.3 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Twardes Sitemap Index)
- [CVE-2023-23817](https://cve.now/CVE-2023-23817.md): WordPress Simple PDF Viewer Plugin \<= 1.9 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, WebArea | Vera Nedvyzhenko Simple PDF Viewer)
- [CVE-2023-23827](https://cve.now/CVE-2023-23827.md): WordPress Google Maps v3 Shortcode Plugin \<= 1.2.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Google Maps v3 Shortcode)
- [CVE-2023-23717](https://cve.now/CVE-2023-23717.md): WordPress Portfolio Slideshow Plugin \<= 1.13.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, George Gecewicz Portfolio Slideshow)
- [CVE-2023-23832](https://cve.now/CVE-2023-23832.md): WordPress Ultimate WP Query Search Filter Plugin \<= 1.0.10 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, TC Ultimate WP Query Search Filter)
- [CVE-2022-44743](https://cve.now/CVE-2022-44743.md): WordPress Jobs for WordPress Plugin \<= 2.5.11.2 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, BlueGlass Jobs for WordPress)
- [CVE-2022-45361](https://cve.now/CVE-2022-45361.md): WordPress 0mk Shortener Plugin \<= 0.2 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Boris Kuzmanov 0mk Shortener)
- [CVE-2023-24404](https://cve.now/CVE-2023-24404.md): WordPress Marketing Performance Plugin \<= 2.0.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, VryaSage Marketing Performance)
- [CVE-2023-24386](https://cve.now/CVE-2023-24386.md): WordPress AI Contact Us Form Plugin \<= 1.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Karishma Arora AI Contact Us Form)
- [CVE-2023-22698](https://cve.now/CVE-2023-22698.md): WordPress Theme Blvd Responsive Google Maps Plugin \<= 1.0.2 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Jason Bobich Theme Blvd Responsive Google Maps)
- [CVE-2023-22718](https://cve.now/CVE-2023-22718.md): WordPress User Meta Manager Plugin \<= 3.4.9 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Jason Lau User Meta Manager)
- [CVE-2022-47435](https://cve.now/CVE-2022-47435.md): WordPress WP-OliveCart Plugin \<= 1.1.3 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Olive Design WP-OliveCart)
- [CVE-2022-44594](https://cve.now/CVE-2022-44594.md): WordPress All in One Time Clock Lite Plugin \<= 1.3.320 is vulnerable to Cross Site Scripting (XSS) (CVSS 4.8, Codebangers All in One Time Clock Lite)
- [CVE-2022-44582](https://cve.now/CVE-2022-44582.md): WordPress Apptivo Business Site CRM Plugin \<= 3.0.12 is vulnerable to Cross Site Scripting (XSS) (CVSS 4.8, Apptivo Business Site CRM)
- [CVE-2022-44631](https://cve.now/CVE-2022-44631.md): WordPress 1app Business Forms Plugin \<= 1.0.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 4.8, 1app Technologies 1app Business Forms)
- [CVE-2023-31043](https://cve.now/CVE-2023-31043.md): EnterpriseDB EDB Postgres Advanced Server (EPAS) before 14.6.0 logs unredacted passwords in situations where optional parameters are used wi (CVSS 7.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-04-23
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.