# CVEs published 2023-10-21

15 CVEs were published on October 21, 2023: 0 critical, 1 high. Days are UTC.

- [CVE-2023-46078](https://cve.now/CVE-2023-46078.md): WordPress Serial Numbers for WooCommerce – License Manager Plugin \<= 1.6.3 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, PluginEver WC Serial Numbers)
- [CVE-2023-46067](https://cve.now/CVE-2023-46067.md): WordPress Rocket Font Plugin \<= 1.2.3 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Qwerty23 Rocket Font)
- [CVE-2023-4939](https://cve.now/CVE-2023-4939.md): SALESmanago \<= 3.2.4 - Log Injection via Weak Authentication Token (CVSS 5.3, salesmanag0 SALESmanago & Leadoo)
- [CVE-2023-5205](https://cve.now/CVE-2023-5205.md): Add Custom Body Class \<= 1.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, anilankola Add Custom Body Class)
- [CVE-2023-4635](https://cve.now/CVE-2023-4635.md): EventON \<= 2.2.2 - Reflected Cross-Site Scripting (CVSS 6.1, ashanjay EventON – Events Calendar)
- [CVE-2023-5684](https://cve.now/CVE-2023-5684.md): Byzoro Smart S85F Management Platform importexport.php os command injection (CVSS 4.7, Byzoro Smart S85F Management Platform)
- [CVE-2023-5683](https://cve.now/CVE-2023-5683.md): Byzoro Smart S85F Management Platform importconf.php os command injection (CVSS 6.3, Byzoro Smart S85F Management Platform)
- [CVE-2023-5132](https://cve.now/CVE-2023-5132.md): Soisy Pagamento Rateale \<= 6.0.1 - Missing Authorization to Sensitive Information Exposure (CVSS 7.5, soisytech Soisy Pagamento Rateale)
- [CVE-2023-38190](https://cve.now/CVE-2023-38190.md): An issue was discovered in SuperWebMailer 9.00.0.01710. (no CVSS)
- [CVE-2023-38192](https://cve.now/CVE-2023-38192.md): An issue was discovered in SuperWebMailer 9.00.0.01710. (no CVSS)
- [CVE-2023-38193](https://cve.now/CVE-2023-38193.md): An issue was discovered in SuperWebMailer 9.00.0.01710. (no CVSS)
- [CVE-2023-38194](https://cve.now/CVE-2023-38194.md): An issue was discovered in SuperWebMailer 9.00.0.01710. (no CVSS)
- [CVE-2023-46003](https://cve.now/CVE-2023-46003.md): I-doit pro 25 and below is vulnerable to Cross Site Scripting (XSS) via index.php. (CVSS 5.4)
- [CVE-2023-46054](https://cve.now/CVE-2023-46054.md): Cross Site Scripting (XSS) vulnerability in WBCE CMS v.1.6.1 and before allows a remote attacker to escalate privileges via a crafted script (no CVSS)
- [CVE-2023-46055](https://cve.now/CVE-2023-46055.md): An issue in ThingNario Photon v.1.0 allows a remote attacker to execute arbitrary code and escalate privileges via a crafted script to the p (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-10-21
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.