# CVEs published 2023-11-12

35 CVEs were published on November 12, 2023: 0 critical, 2 high. Days are UTC.

- [CVE-2023-26531](https://cve.now/CVE-2023-26531.md): WordPress 多合一搜索自动推送管理插件-支持Baidu/Google/Bing/IndexNow/Yandex/头条 Plugin \<= 4.2.7 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, 闪电博 多合一搜索自动推送管理插件-支持Baidu/Google/Bing/IndexNow/Yandex/头条)
- [CVE-2023-26524](https://cve.now/CVE-2023-26524.md): WordPress Quiz And Survey Master Plugin \<= 8.0.10 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, ExpressTech Quiz And Survey Master – Best Quiz, Exam and Su…)
- [CVE-2023-26516](https://cve.now/CVE-2023-26516.md): WordPress Debug Assistant Plugin \<= 1.4 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 8.8, WPIndeed Debug Assistant)
- [CVE-2023-26518](https://cve.now/CVE-2023-26518.md): WordPress WP TFeed Plugin \<= 1.6.9 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, AccessPress Themes WP TFeed)
- [CVE-2023-26514](https://cve.now/CVE-2023-26514.md): WordPress XML Sitemap Generator for Google Plugin \<= 1.3.3 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, WPGrim Dynamic XML Sitemaps Generator for Google)
- [CVE-2023-27445](https://cve.now/CVE-2023-27445.md): WordPress Blog Floating Button Plugin \<= 1.4.12 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, Meril Blog Floating Button)
- [CVE-2023-27441](https://cve.now/CVE-2023-27441.md): WordPress New Adman Plugin \<= 1.6.8 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, gl\_SPICE New Adman)
- [CVE-2023-27438](https://cve.now/CVE-2023-27438.md): WordPress WP Translitera Plugin \<= p1.2.5 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Evgen Yurchenko WP Translitera)
- [CVE-2023-27434](https://cve.now/CVE-2023-27434.md): WordPress Classic Editor and Classic Widgets Plugin \<= 1.2.5 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, WPGrim Classic Editor and Classic Widgets)
- [CVE-2023-27436](https://cve.now/CVE-2023-27436.md): WordPress Elegant Custom Fonts Plugin \<= 1.0 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, Louis Reingold Elegant Custom Fonts)
- [CVE-2023-27431](https://cve.now/CVE-2023-27431.md): WordPress Big Store Theme \<= 1.9.3 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, ThemeHunk Big Store)
- [CVE-2023-27417](https://cve.now/CVE-2023-27417.md): WordPress Affiliate Super Assistent Plugin \<= 1.5.1 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Timo Reith Affiliate Super Assistent)
- [CVE-2023-27418](https://cve.now/CVE-2023-27418.md): WordPress Side Menu Lite Plugin \<= 4.0 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Wow-Company Side Menu Lite – add sticky fixed buttons)
- [CVE-2023-27632](https://cve.now/CVE-2023-27632.md): WordPress Daily Prayer Time Plugin \<= 2023.03.08 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, mmrs151 Daily Prayer Time)
- [CVE-2023-27623](https://cve.now/CVE-2023-27623.md): WordPress WP Page Numbers Plugin \<= 0.5 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, Jens Törnell WP Page Numbers)
- [CVE-2023-28134](https://cve.now/CVE-2023-28134.md): Local Privliege Escalation in Check Point Endpoint Security Remediation Service (CVSS 7.8, checkpoint Harmony Endpoint.)
- [CVE-2023-27611](https://cve.now/CVE-2023-27611.md): WordPress Reusable Blocks Extended Plugin \<= 0.9 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, audrasjb Reusable Blocks Extended)
- [CVE-2023-28167](https://cve.now/CVE-2023-28167.md): WordPress CF7 Invisible reCAPTCHA Plugin \<= 1.3.3 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, Vsourz Digital CF7 Invisible reCAPTCHA)
- [CVE-2023-28172](https://cve.now/CVE-2023-28172.md): WordPress WP Google Map Plugin Plugin \<= 4.4.2 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, flippercode WordPress Plugin for Google Maps – WP MAPS)
- [CVE-2023-28173](https://cve.now/CVE-2023-28173.md): WordPress Google XML Sitemap for Images Plugin \<= 2.1.3 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Amit Agarwal Google XML Sitemap for Images)
- [CVE-2023-28419](https://cve.now/CVE-2023-28419.md): WordPress Force First and Last Name as Display Name Plugin \<= 1.2 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, Stranger Studios Force First and Last Name as Display Name)
- [CVE-2023-28420](https://cve.now/CVE-2023-28420.md): WordPress Custom Options Plus Plugin \<= 1.8.1 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, Leo Caseiro Custom Options Plus)
- [CVE-2023-28495](https://cve.now/CVE-2023-28495.md): WordPress WP Shortcode by MyThemeShop Plugin \<= 1.4.16 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, WP Shortcode by MyThemeShop)
- [CVE-2023-28497](https://cve.now/CVE-2023-28497.md): WordPress Slideshow Gallery Plugin \<= 1.7.6 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, Tribulant Slideshow Gallery LITE)
- [CVE-2023-28498](https://cve.now/CVE-2023-28498.md): WordPress Hotel Booking Lite Plugin \<= 4.6.0 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, MotoPress Hotel Booking Lite)
- [CVE-2023-28618](https://cve.now/CVE-2023-28618.md): WordPress Enhanced Plugin Admin Plugin \<= 1.16 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, Marios Alexandrou Enhanced Plugin Admin)
- [CVE-2023-28694](https://cve.now/CVE-2023-28694.md): WordPress Wbcom Designs – BuddyPress Activity Social Share Plugin \<= 3.5.0 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, Wbcom Designs – BuddyPress Activity Social Share)
- [CVE-2023-28696](https://cve.now/CVE-2023-28696.md): WordPress I Recommend This Plugin \<= 3.9.0 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Harish Chouhan, Themeist I Recommend This)
- [CVE-2023-28930](https://cve.now/CVE-2023-28930.md): WordPress Mobile Banner Plugin \<= 1.5 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Robin Phillips Mobile Banner)
- [CVE-2023-28987](https://cve.now/CVE-2023-28987.md): WordPress Wp Ultimate Review Plugin \<= 2.0.3 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Wpmet Wp Ultimate Review)
- [CVE-2023-29238](https://cve.now/CVE-2023-29238.md): WordPress Whydonate – FREE Donate button Plugin \<= 3.12.15 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Whydonate – FREE Donate button – Crowdfunding – Fundraising)
- [CVE-2023-29425](https://cve.now/CVE-2023-29425.md): WordPress ShiftController Employee Shift Scheduling Plugin \<= 4.9.23 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, plainware.com ShiftController Employee Shift Scheduling)
- [CVE-2023-42781](https://cve.now/CVE-2023-42781.md): Apache Airflow: Permission verification bypass allows viewing dagruns of other dags (low (no CVSS), Apache Software Foundation Apache Airflow · apache-airflow)
- [CVE-2023-47037](https://cve.now/CVE-2023-47037.md): Apache Airflow missing fix for CVE-2023-40611 in 2.7.1 (DAG run broken access) (low (no CVSS), Apache Software Foundation Apache Airflow · apache-airflow)
- [CVE-2023-6084](https://cve.now/CVE-2023-6084.md): Tongda OA 2017 delete.php sql injection (CVSS 6.3, Tongda OA)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-11-12
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.