# CVEs published 2023-05-20

23 CVEs were published on May 20, 2023: 3 critical, 8 high. Days are UTC.

- [CVE-2022-47134](https://cve.now/CVE-2022-47134.md): WordPress Gallery Metabox Plugin \<= 1.5 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Bill Erickson Gallery Metabox)
- [CVE-2023-32589](https://cve.now/CVE-2023-32589.md): WordPress Dyslexiefont Free Plugin \<= 1.0.0 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, PingOnline Dyslexiefont Free)
- [CVE-2023-22689](https://cve.now/CVE-2023-22689.md): WordPress Auto Affiliate Links Plugin \<= 6.3 is vulnerable to Broken Access Control (CVSS 5.4, Lucian Apostol Auto Affiliate Links)
- [CVE-2023-23890](https://cve.now/CVE-2023-23890.md): WordPress WP Airbnb Review Slider Plugin \<= 3.2 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 7.1, LJ Apps WP Airbnb Review Slider)
- [CVE-2023-24414](https://cve.now/CVE-2023-24414.md): WordPress Robo Gallery Plugin \<= 3.2.11 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, RoboSoft Photo Gallery, Images, Slider in Rbs Image Gallery)
- [CVE-2023-1696](https://cve.now/CVE-2023-1696.md): The multimedia video module has a vulnerability in data processing.Successful exploitation of this vulnerability may affect availability. (CVSS 7.5, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2023-1694](https://cve.now/CVE-2023-1694.md): The Settings module has the file privilege escalation vulnerability.Successful exploitation of this vulnerability may affect confidentiality (CVSS 7.5, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2023-1693](https://cve.now/CVE-2023-1693.md): The Settings module has the file privilege escalation vulnerability.Successful exploitation of this vulnerability may affect confidentiality (CVSS 7.5, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2023-1692](https://cve.now/CVE-2023-1692.md): The window management module lacks permission verification.Successful exploitation of this vulnerability may affect confidentiality. (CVSS 7.5, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2023-2713](https://cve.now/CVE-2023-2713.md): IDOR vulnerability in "Rental Module" developed by third-party for Ideasoft's E-commerce Platform. (CVSS 9.8, Rental Module)
- [CVE-2023-2712](https://cve.now/CVE-2023-2712.md): Malicious File Upload vulnerability in "Rental Module" developed by third-party for Ideasoft's E-commerce Platform. (CVSS 9.8, Rental Module)
- [CVE-2023-2824](https://cve.now/CVE-2023-2824.md): SourceCodester Dental Clinic Appointment Reservation System POST Parameter service.php cross site scripting (CVSS 3.5, SourceCodester Dental Clinic Appointment Reservation System)
- [CVE-2023-2823](https://cve.now/CVE-2023-2823.md): SourceCodester Class Scheduling System GET Parameter edit\_subject.php sql injection (CVSS 6.3, SourceCodester Class Scheduling System)
- [CVE-2023-2822](https://cve.now/CVE-2023-2822.md): Ellucian Ethos Identity logout cross site scripting (CVSS 4.3, Ellucian Ethos Identity)
- [CVE-2023-2276](https://cve.now/CVE-2023-2276.md): WCFM Membership – WooCommerce Memberships for Multivendor Marketplace \<= 2.10.7 - Unauthenticated Insecure Direct Object Reference to Arbitrary User Password Change (CVSS 9.8, wclovers WCFM Membership – WooCommerce Memberships for Mult…)
- [CVE-2023-2717](https://cve.now/CVE-2023-2717.md): Groundhogg \<= 2.7.9.8 - Cross-Site Request Forgery to Disable All Plugins (CVSS 5.4, trainingbusinesspros Groundhogg — CRM, Newsletters, and Mar…)
- [CVE-2023-2736](https://cve.now/CVE-2023-2736.md): Groundhogg \<= 2.7.9.8 - Cross-Site Request Forgery to Privilege Escalation (CVSS 7.5, trainingbusinesspros Groundhogg — CRM, Newsletters, and Mar…)
- [CVE-2023-2735](https://cve.now/CVE-2023-2735.md): Groundhogg \<= 2.7.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 4.9, trainingbusinesspros Groundhogg — CRM, Newsletters, and Mar…)
- [CVE-2023-2716](https://cve.now/CVE-2023-2716.md): Groundhogg \<= 2.7.9.8 - Missing Authorization to Non-Arbitrary File Upload (CVSS 5.4, trainingbusinesspros Groundhogg — CRM, Newsletters, and Mar…)
- [CVE-2023-2714](https://cve.now/CVE-2023-2714.md): Groundhogg \<= 2.7.9.8 - Missing Authorization to Update License (CVSS 4.3, trainingbusinesspros Groundhogg — CRM, Newsletters, and Mar…)
- [CVE-2023-2715](https://cve.now/CVE-2023-2715.md): Groundhogg \<= 2.7.9.8 - Missing Authorization to Admin Account and Ticket Creation (CVSS 4.3, trainingbusinesspros Groundhogg — CRM, Newsletters, and Mar…)
- [CVE-2023-32700](https://cve.now/CVE-2023-32700.md): LuaTeX before 1.17.0 allows execution of arbitrary shell commands when compiling a TeX file obtained from an untrusted source. (CVSS 8.8)
- [CVE-2023-33244](https://cve.now/CVE-2023-33244.md): Obsidian before 1.2.2 allows calls to unintended APIs (for microphone access, camera access, and desktop notification) via an embedded web p (CVSS 8.2)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-05-20
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.