CVEs published May 28, 2023
34 CVEs were published on May 28, 2023: 0 critical, 14 high.
- Published
- 34
- Critical
- 0
- High
- 14
- Medium
- 19
- Low
- 0
- Unrated
- 1
- Now in CISA KEV
- 0
- Fix available
- 6
Most affected products
- openemr/openemr
- 3
- WooCommerce Follow-Up Emails
- 2
- André Bräkling WP-Matomo Integration
- 1
- Awesome Motive Duplicator Pro
- 1
- Ciprian Popescu YouTube Playlist Player
- 1
- code-projects Bus Dispatch and Information System
- 1
- CRM Perks Contact Form Entries
- 1
- Crocoblock JetFormBuilder — Dynamic Blocks Form Builder
- 1
- EventPrime
- 1
- gVectors Team WooDiscuz – WooCommerce Comments
- 1
High 14
- CVE-2023-33926WordPress Easy Google Maps Plugin <= 1.11.7 is vulnerable to Cross Site Request Forgery (CSRF)Supsystic Easy Google Maps
- CVE-2023-33332WordPress WooCommerce Product Vendors Plugin <= 2.1.76 is vulnerable to Cross Site Scripting (XSS)WooCommerce Product Vendors
- CVE-2023-32800WordPress Rank Math SEO PRO Plugin <= 3.0.35 is vulnerable to Cross Site Scripting (XSS)One Rank Math SEO PRO
- CVE-2023-33319WordPress WooCommerce Follow-Up Emails Plugin <= 4.9.40 is vulnerable to Cross Site Scripting (XSS)WooCommerce Follow-Up Emails
- CVE-2023-33326WordPress EventPrime Plugin <= 2.8.6 is vulnerable to Cross Site Scripting (XSS)EventPrime
- CVE-2023-33309WordPress Duplicator Pro Plugin <= 4.5.11 is vulnerable to Cross Site Scripting (XSS)Awesome Motive Duplicator Pro
- CVE-2023-29380Warpinator before 1.6.0 allows remote file deletion via directory traversal in top_dir_basenames.
- CVE-2023-2948Cross-site Scripting (XSS) - Generic in openemr/openemropenemr/openemr
- CVE-2023-2949Cross-site Scripting (XSS) - Reflected in openemr/openemropenemr/openemr
- CVE-2023-30350FS S3900-24T4S devices allow authenticated attackers with guest access to escalate their privileges and reset the admin password.
- CVE-2023-30570pluto in Libreswan before 4.11 allows a denial of service (responder SPI mishandling and daemon crash) via unauthenticated IKEv1 Aggressive
- CVE-2023-31873Gin 0.7.4 allows execution of arbitrary code when a crafted file is opened, e.g., via require('child_process').
- CVE-2023-31874Yank Note (YN) 3.52.1 allows execution of arbitrary code when a crafted file is opened, e.g., via nodeRequire('child_process').
- CVE-2023-33291In ebankIT 6, the public endpoints /public/token/Email/generate and /public/token/SMS/generate allow generation of OTP messages to any e-mai
Medium, low and unrated 20
- CVE-2021-4336ITRS Group monitor-ninja scheduled_reports.php sql injectionITRS Group monitor-ninja
- CVE-2022-36345WordPress Download Plugin Plugin <= 2.0.4 is vulnerable to Cross Site Request Forgery (CSRF)Metagauss Download Plugin
- CVE-2023-28785WordPress Yoast SEO: Local Plugin <= 14.9 is vulnerable to Cross Site Scripting (XSS)Yoast SEO: Local
- CVE-2023-33311WordPress Contact Form Entries Plugin <= 1.3.0 is vulnerable to Cross Site Scripting (XSS)CRM Perks Contact Form Entries
- CVE-2023-33313WordPress WIP Custom Login Plugin <= 1.2.9 is vulnerable to Cross Site Request Forgery (CSRF)ThemeinProgress WIP Custom Login
- CVE-2023-33211WordPress WP-Piwik Plugin <= 1.0.27 is vulnerable to Cross Site Scripting (XSS)André Bräkling WP-Matomo Integration
- CVE-2023-33316WordPress WooCommerce Follow-Up Emails (AutomateWoo) plugin <= 4.9.40 is vulnerable to Cross Site Request Forgery (CSRF)WooCommerce Follow-Up Emails
- CVE-2023-33328WordPress MailChimp Subscribe Forms Plugin <= 4.0.9.1 is vulnerable to Cross Site Scripting (XSS)PluginOps MailChimp Subscribe Form
- CVE-2023-33314WordPress BEAR Plugin <= 1.1.3.1 is vulnerable to Cross Site Request Forgery (CSRF)realmag777 BEAR
- CVE-2023-33212WordPress JetFormBuilder Plugin <= 3.0.6 is vulnerable to Cross Site Request Forgery (CSRF)Crocoblock JetFormBuilder — Dynamic Blocks Form Builder
- CVE-2023-33931WordPress YouTube Playlist Player Plugin <= 4.6.4 is vulnerable to Cross Site Request Forgery (CSRF)Ciprian Popescu YouTube Playlist Player
- CVE-2023-33315WordPress Smart App Banner Plugin <= 1.1.2 is vulnerable to Cross Site Request Forgery (CSRF)Stephen Darlington, Wandle Software Limited Smart App Banner
- CVE-2023-32958WordPress Novelist Plugin <= 1.2.0 is vulnerable to Cross Site Scripting (XSS)Nose Graze Novelist
- CVE-2023-33216WordPress WooDiscuz – WooCommerce Comments Plugin <= 2.2.9 is vulnerable to Cross Site Scripting (XSS)gVectors Team WooDiscuz – WooCommerce Comments
- CVE-2015-10106mback2k mh_httpbl Extension index.php moduleContent sql injectionmback2k mh_httpbl Extension
- CVE-2014-125101Portfolio Gallery Plugin sql injectionPortfolio Gallery Plugin
- CVE-2023-2951code-projects Bus Dispatch and Information System delete_bus.php sql injectioncode-projects Bus Dispatch and Information System
- CVE-2023-2950Improper Authorization in openemr/openemropenemr/openemr
- CVE-2023-32762An issue was discovered in Qt before 5.15.14, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1.
- CVE-2023-32763An issue was discovered in Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1.