# CVEs published 2023-05-28

34 CVEs were published on May 28, 2023: 0 critical, 14 high. Days are UTC.

- [CVE-2021-4336](https://cve.now/CVE-2021-4336.md): ITRS Group monitor-ninja scheduled\_reports.php sql injection (CVSS 5.5, ITRS Group monitor-ninja)
- [CVE-2022-36345](https://cve.now/CVE-2022-36345.md): WordPress Download Plugin Plugin \<= 2.0.4 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Metagauss Download Plugin)
- [CVE-2023-33926](https://cve.now/CVE-2023-33926.md): WordPress Easy Google Maps Plugin \<= 1.11.7 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 7.1, Supsystic Easy Google Maps)
- [CVE-2023-33332](https://cve.now/CVE-2023-33332.md): WordPress WooCommerce Product Vendors Plugin \<= 2.1.76 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, WooCommerce Product Vendors)
- [CVE-2023-28785](https://cve.now/CVE-2023-28785.md): WordPress Yoast SEO: Local Plugin \<= 14.9 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Yoast SEO: Local)
- [CVE-2023-32800](https://cve.now/CVE-2023-32800.md): WordPress Rank Math SEO PRO Plugin \<= 3.0.35 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, One Rank Math SEO PRO)
- [CVE-2023-33311](https://cve.now/CVE-2023-33311.md): WordPress Contact Form Entries Plugin \<= 1.3.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, CRM Perks Contact Form Entries)
- [CVE-2023-33313](https://cve.now/CVE-2023-33313.md): WordPress WIP Custom Login Plugin \<= 1.2.9 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, ThemeinProgress WIP Custom Login)
- [CVE-2023-33211](https://cve.now/CVE-2023-33211.md): WordPress WP-Piwik Plugin \<= 1.0.27 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, André Bräkling WP-Matomo Integration)
- [CVE-2023-33319](https://cve.now/CVE-2023-33319.md): WordPress WooCommerce Follow-Up Emails Plugin \<= 4.9.40 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, WooCommerce Follow-Up Emails)
- [CVE-2023-33316](https://cve.now/CVE-2023-33316.md): WordPress WooCommerce Follow-Up Emails (AutomateWoo) plugin \<= 4.9.40 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, WooCommerce Follow-Up Emails)
- [CVE-2023-33328](https://cve.now/CVE-2023-33328.md): WordPress MailChimp Subscribe Forms Plugin \<= 4.0.9.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, PluginOps MailChimp Subscribe Form)
- [CVE-2023-33326](https://cve.now/CVE-2023-33326.md): WordPress EventPrime Plugin \<= 2.8.6 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, EventPrime)
- [CVE-2023-33309](https://cve.now/CVE-2023-33309.md): WordPress Duplicator Pro Plugin \<= 4.5.11 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Awesome Motive Duplicator Pro)
- [CVE-2023-33314](https://cve.now/CVE-2023-33314.md): WordPress BEAR Plugin \<= 1.1.3.1 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, realmag777 BEAR)
- [CVE-2023-33212](https://cve.now/CVE-2023-33212.md): WordPress JetFormBuilder Plugin \<= 3.0.6 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Crocoblock JetFormBuilder — Dynamic Blocks Form Builder)
- [CVE-2023-33931](https://cve.now/CVE-2023-33931.md): WordPress YouTube Playlist Player Plugin \<= 4.6.4 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Ciprian Popescu YouTube Playlist Player)
- [CVE-2023-33315](https://cve.now/CVE-2023-33315.md): WordPress Smart App Banner Plugin \<= 1.1.2 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, Stephen Darlington, Wandle Software Limited Smart App Banner)
- [CVE-2023-32958](https://cve.now/CVE-2023-32958.md): WordPress Novelist Plugin \<= 1.2.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Nose Graze Novelist)
- [CVE-2023-33216](https://cve.now/CVE-2023-33216.md): WordPress WooDiscuz – WooCommerce Comments Plugin \<= 2.2.9 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, gVectors Team WooDiscuz – WooCommerce Comments)
- [CVE-2015-10106](https://cve.now/CVE-2015-10106.md): mback2k mh\_httpbl Extension index.php moduleContent sql injection (CVSS 6.3, mback2k mh\_httpbl Extension)
- [CVE-2014-125101](https://cve.now/CVE-2014-125101.md): Portfolio Gallery Plugin sql injection (CVSS 6.3, Portfolio Gallery Plugin)
- [CVE-2023-2951](https://cve.now/CVE-2023-2951.md): code-projects Bus Dispatch and Information System delete\_bus.php sql injection (CVSS 6.3, code-projects Bus Dispatch and Information System)
- [CVE-2023-29380](https://cve.now/CVE-2023-29380.md): Warpinator before 1.6.0 allows remote file deletion via directory traversal in top\_dir\_basenames. (CVSS 7.5)
- [CVE-2023-2948](https://cve.now/CVE-2023-2948.md): Cross-site Scripting (XSS) - Generic in openemr/openemr (CVSS 8.3, openemr/openemr)
- [CVE-2023-2949](https://cve.now/CVE-2023-2949.md): Cross-site Scripting (XSS) - Reflected in openemr/openemr (CVSS 8.3, openemr/openemr)
- [CVE-2023-2950](https://cve.now/CVE-2023-2950.md): Improper Authorization in openemr/openemr (CVSS 6.3, openemr/openemr)
- [CVE-2023-30350](https://cve.now/CVE-2023-30350.md): FS S3900-24T4S devices allow authenticated attackers with guest access to escalate their privileges and reset the admin password. (CVSS 8.8)
- [CVE-2023-30570](https://cve.now/CVE-2023-30570.md): pluto in Libreswan before 4.11 allows a denial of service (responder SPI mishandling and daemon crash) via unauthenticated IKEv1 Aggressive (CVSS 7.5)
- [CVE-2023-31873](https://cve.now/CVE-2023-31873.md): Gin 0.7.4 allows execution of arbitrary code when a crafted file is opened, e.g., via require('child\_process'). (CVSS 7.8)
- [CVE-2023-31874](https://cve.now/CVE-2023-31874.md): Yank Note (YN) 3.52.1 allows execution of arbitrary code when a crafted file is opened, e.g., via nodeRequire('child\_process'). (CVSS 8.8)
- [CVE-2023-32762](https://cve.now/CVE-2023-32762.md): An issue was discovered in Qt before 5.15.14, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1. (CVSS 5.3)
- [CVE-2023-32763](https://cve.now/CVE-2023-32763.md): An issue was discovered in Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1. (no CVSS)
- [CVE-2023-33291](https://cve.now/CVE-2023-33291.md): In ebankIT 6, the public endpoints /public/token/Email/generate and /public/token/SMS/generate allow generation of OTP messages to any e-mai (CVSS 7.4)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-05-28
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.