# CVEs published 2023-07-01

38 CVEs were published on July 1, 2023: 0 critical, 1 high. Days are UTC.

- [CVE-2020-36749](https://cve.now/CVE-2020-36749.md): Easy Testimonials \<= 3.6.1 - Cross-Site Request Forgery Bypass (CVSS 4.3, ghuger Easy Testimonials)
- [CVE-2021-4405](https://cve.now/CVE-2021-4405.md): ElasticPress \<= 3.5.3 - Cross-Site Request Forgery Bypass (CVSS 4.3, 10up ElasticPress)
- [CVE-2021-4404](https://cve.now/CVE-2021-4404.md): Event Espresso 4 Decaf \<= 4.10.11 - Cross-Site Request Forgery Bypass (CVSS 4.3, eventespresso Event Espresso – Event Registration & Ticketi…)
- [CVE-2021-4403](https://cve.now/CVE-2021-4403.md): Remove Schema \<= 1.5 - Cross-Site Request Forgery Bypass (CVSS 4.3, timvaniersel Remove Schema)
- [CVE-2020-36748](https://cve.now/CVE-2020-36748.md): Dokan \<= 3.0.8 - Cross-Site Request Forgery Bypass (CVSS 4.3, dokaninc Dokan: AI Powered WooCommerce Multivendor Marketpl…)
- [CVE-2021-4402](https://cve.now/CVE-2021-4402.md): Multiple Roles \<= 1.3.1- Cross-Site Request Forgery Bypass (CVSS 4.3, cneumann Multiple Roles)
- [CVE-2020-36747](https://cve.now/CVE-2020-36747.md): Lightweight Sidebar Manager \<= 1.1.4 - Cross-Site Request Forgery Bypass (CVSS 4.3, brainstormforce Lightweight Sidebar Manager)
- [CVE-2021-4401](https://cve.now/CVE-2021-4401.md): Style Kits \<= 1.8.0 - Cross-Site Request Forgery Bypass (CVSS 8.8, analogwp Style Kits – Advanced Theme Styles for Elementor,…)
- [CVE-2021-4400](https://cve.now/CVE-2021-4400.md): Better Search \<= 2.5.2 - Cross-Site Request Forgery Bypass (CVSS 4.3, ajay Better Search – Relevant search results for WordPress)
- [CVE-2021-4399](https://cve.now/CVE-2021-4399.md): Edwiser Bridge \<= 2.0.6 - Cross-Site Request Forgery Bypass (CVSS 4.3, wisdmlabs Edwiser Bridge – WordPress Moodle Integration)
- [CVE-2021-4398](https://cve.now/CVE-2021-4398.md): Amministrazione Trasparente \<= 7.1 - Cross-Site Request Forgery Bypass (CVSS 4.3, milmor Amministrazione Trasparente)
- [CVE-2021-4397](https://cve.now/CVE-2021-4397.md): Staff Directory Plugin \<= 3.6 - Cross-Site Request Forgery Bypass (CVSS 4.3, richardgabriel Staff Directory Plugin: Company Directory)
- [CVE-2021-4396](https://cve.now/CVE-2021-4396.md): Rucy \<= 0.4.4 - Cross-Site Request Forgery Bypass (CVSS 4.3, gips-nita Rucy)
- [CVE-2020-36746](https://cve.now/CVE-2020-36746.md): Menu Swapper \<= 1.1.0.2 - Cross-Site Request Forgery Bypass (CVSS 4.3, sevenspark Menu Swapper)
- [CVE-2021-4395](https://cve.now/CVE-2021-4395.md): Abandoned Cart Recovery for WooCommerce \<= 1.0.4 - Cross-Site Request Forgery Bypass (CVSS 4.3, villatheme Abandoned Cart Recovery for WooCommerce)
- [CVE-2023-26136](https://cve.now/CVE-2023-26136.md): Versions of the package tough-cookie before 4.1.3 are vulnerable to Prototype Pollution due to improper handling of Cookies when using Cooki (CVSS 6.5, tough-cookie)
- [CVE-2021-4388](https://cve.now/CVE-2021-4388.md): Opal Estate \<= 1.6.11 - Missing Authorization (CVSS 4.3, wpopal Opal Estate)
- [CVE-2020-36745](https://cve.now/CVE-2020-36745.md): WP Project Manager \<= 2.4.0 - Cross-Site Request Forgery Bypass (CVSS 4.3, wedevs Project Manager – AI Powered Project Management, Tas…)
- [CVE-2020-36744](https://cve.now/CVE-2020-36744.md): NotificationX \<= 1.8.2 - Cross-Site Request Forgery Bypass (CVSS 4.3, wpdevteam NotificationX – FOMO, Live Sales Notification, Wo…)
- [CVE-2021-4394](https://cve.now/CVE-2021-4394.md): Locations \<= 3.2.1 - Cross-Site Request Forgery Bypass (CVSS 4.3, richardgabriel Locations)
- [CVE-2020-36743](https://cve.now/CVE-2020-36743.md): Product Catalog Simple \<= 1.5.13 - Cross-Site Request Forgery Bypass (CVSS 4.3, implecode Product Catalog Simple)
- [CVE-2020-36742](https://cve.now/CVE-2020-36742.md): Custom Field Template \<= 2.5.1 - Cross-Site Request Forgery Bypass (CVSS 4.3, hiroaki-miyashita Custom Field Template)
- [CVE-2021-4392](https://cve.now/CVE-2021-4392.md): eCommerce Product Catalog Plugin for WordPress \<= 2.9.43 - Cross-Site Request Forgery Bypass (CVSS 4.3, implecode eCommerce Product Catalog Plugin for WordPress)
- [CVE-2021-4391](https://cve.now/CVE-2021-4391.md): Ultimate Gift Cards for WooCommerce \<= 2.1.1 - Cross-Site Request Forgery Bypass (CVSS 4.3, wpswings Ultimate Gift Cards for WooCommerce)
- [CVE-2020-36741](https://cve.now/CVE-2020-36741.md): MultiVendorX – MultiVendor Marketplace Solution For WooCommerce \<= 3.5.7 - Cross-Site Request Forgery Bypass (CVSS 4.3, wcmp MultiVendorX – WooCommerce Multivendor Marketplace Sol…)
- [CVE-2021-4390](https://cve.now/CVE-2021-4390.md): Contact Form 7 Style \<= 3.2 - Cross-Site Request Forgery Bypass (CVSS 4.3, ionuticlanzan Contact Form 7 Style)
- [CVE-2021-4389](https://cve.now/CVE-2021-4389.md): WP Travel \<= 4.4.6 - Cross-Site Request Forgery Bypass (CVSS 4.3, wptravel WP Travel – Ultimate Travel Booking System, Tour M…)
- [CVE-2020-36740](https://cve.now/CVE-2020-36740.md): Radio Buttons for Taxonomies \<= 2.0.5 - Cross-Site Request Forgery Bypass (CVSS 4.3, helgatheviking Radio Buttons for Taxonomies)
- [CVE-2021-4393](https://cve.now/CVE-2021-4393.md): eCommerce Product Catalog Plugin for WordPress \<= 3.0.17 - Cross-Site Request Forgery Bypass (CVSS 4.3, implecode eCommerce Product Catalog Plugin for WordPress)
- [CVE-2021-4387](https://cve.now/CVE-2021-4387.md): Opal Estate \<= 1.6.11 - Cross-Site Request Forgery Bypass (CVSS 4.3, wpopal Opal Estate)
- [CVE-2021-4386](https://cve.now/CVE-2021-4386.md): WP Security Question \<= 1.0.5 - Cross-Site Request Forgery Bypass (CVSS 4.3, flippercode WP Security Question)
- [CVE-2021-4385](https://cve.now/CVE-2021-4385.md): WP Private Content Plus \<= 3.1 - Cross-Site Request Forgery Bypass (CVSS 4.3, nimeshrmr WP Private Content Plus)
- [CVE-2020-36739](https://cve.now/CVE-2020-36739.md): Feed Them Social – Page, Post, Video, and Photo Galleries \<= 2.8.6 - Cross-Site Request Forgery Bypass (CVSS 4.3, slickremix Feed Them Social – Social Media Feeds, Video, an…)
- [CVE-2020-36738](https://cve.now/CVE-2020-36738.md): Cool Timeline (Horizontal & Vertical Timeline) \<= 2.0.2 - Cross-Site Request Forgery Bypass (CVSS 4.3, narinder-singh Cool Timeline)
- [CVE-2020-36737](https://cve.now/CVE-2020-36737.md): Import / Export Customizer Settings \<= 1.0.3 - Cross-Site Request Forgery Bypass (CVSS 4.3, brainstormforce Import / Export Customizer Settings)
- [CVE-2021-4384](https://cve.now/CVE-2021-4384.md): WordPress Photo Gallery – Image Gallery \<= 1.0.6 - Cross-Site Request Forgery Bypass (CVSS 4.3, origincode WordPress Photo Gallery – Image Gallery)
- [CVE-2020-36736](https://cve.now/CVE-2020-36736.md): WooCommerce Checkout & Funnel Builder by CartFlows – Create High Converting Stores For WooCommerce \<= 1.5.15 - Cross-Site Request Forgery Bypass (CVSS 4.3, brainstormforce CartFlows – Funnel Builder & Checkout Plugi…)
- [CVE-2020-36735](https://cve.now/CVE-2020-36735.md): WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting \<= 1.6.3 - Cross-Site Request Forgery Bypass (CVSS 4.3, wedevs ERP: Complete HR, Accounting & CRM Suite with WooCom…)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-07-01
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.