# CVEs published 2023-11-13

81 CVEs were published on November 13, 2023: 1 critical, 25 high. Days are UTC.

- [CVE-2023-47657](https://cve.now/CVE-2023-47657.md): WordPress Direct Checkout – Quick View – Buy Now For WooCommerce Plugin \<= 1.5.8 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, GrandPlugins Direct Checkout – Quick View – Buy Now For Woo…)
- [CVE-2023-47662](https://cve.now/CVE-2023-47662.md): WordPress Live Gold Price & Silver Price Charts Widgets Plugin \<= 2.4 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, GoldBroker.com Live Gold Price & Silver Price Charts Widgets)
- [CVE-2023-47665](https://cve.now/CVE-2023-47665.md): WordPress Plainview Protect Passwords Plugin \<= 1.4 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, edward\_plainview Plainview Protect Passwords)
- [CVE-2023-47673](https://cve.now/CVE-2023-47673.md): WordPress Post Pay Counter Plugin \<= 2.784 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Stefano Ottolenghi Post Pay Counter)
- [CVE-2023-47680](https://cve.now/CVE-2023-47680.md): WordPress Qi Addons For Elementor Plugin \<= 1.6.3 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Qode Interactive Qi Addons For Elementor)
- [CVE-2023-47684](https://cve.now/CVE-2023-47684.md): WordPress Essential Grid Plugin \<= 3.1.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, ThemePunch OHG Essential Grid)
- [CVE-2023-47690](https://cve.now/CVE-2023-47690.md): WordPress Additional Order Filters for WooCommerce Plugin \<= 1.10 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Anton Bond Additional Order Filters for WooCommerce)
- [CVE-2023-47695](https://cve.now/CVE-2023-47695.md): WordPress Shortcodes Finder Plugin \<= 1.5.3 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Scribit Shortcodes Finder)
- [CVE-2023-47696](https://cve.now/CVE-2023-47696.md): WordPress Product Enquiry for WooCommerce Plugin \<= 3.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Gravity Master Product Enquiry for WooCommerce)
- [CVE-2023-4603](https://cve.now/CVE-2023-4603.md): Star CloudPRNT for WooCommerce \<= 2.0.3 - Reflected Cross-Site Scripting (CVSS 6.1, fmahmood Star CloudPRNT for WooCommerce)
- [CVE-2023-47697](https://cve.now/CVE-2023-47697.md): WordPress WP Event Manager Plugin \<= 3.1.39 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, WP Event Manager – Events Calendar, Registrations, Sell Tic…)
- [CVE-2023-47625](https://cve.now/CVE-2023-47625.md): Global Buffer Overflow leading to denial of service in PX4-Autopilot (CVSS 2.9, PX4-Autopilot)
- [CVE-2023-42813](https://cve.now/CVE-2023-42813.md): Denial of service from malicious manifest in kyverno (CVSS 6.1, kyverno · github.com/kyverno/kyverno)
- [CVE-2023-42814](https://cve.now/CVE-2023-42814.md): Denial of service from malicious image manifest in kyverno (CVSS 3.1, kyverno · github.com/kyverno/kyverno)
- [CVE-2023-42815](https://cve.now/CVE-2023-42815.md): Denial of service from malicious image manifest in kyverno (CVSS 3.1, kyverno · github.com/kyverno/kyverno)
- [CVE-2023-42816](https://cve.now/CVE-2023-42816.md): Denial of service from malicious signature in kyverno (CVSS 6.1, kyverno · github.com/kyverno/kyverno)
- [CVE-2023-47117](https://cve.now/CVE-2023-47117.md): Object Relational Mapper Leak Vulnerability in Filtering Task in Label Studio (CVSS 7.5, HumanSignal label-studio · label-studio)
- [CVE-2023-47621](https://cve.now/CVE-2023-47621.md): Remote code execution via file uploads in guest-entries (CVSS 8.8, duncanmcclean guest-entries · duncanmcclean/guest-entries +1)
- [CVE-2023-6103](https://cve.now/CVE-2023-6103.md): Intelbras RX 1500 SSID WiFi.html cross site scripting (CVSS 2.4, Intelbras RX)
- [CVE-2023-6102](https://cve.now/CVE-2023-6102.md): Maiwei Safety Production Control Platform unrestricted upload (CVSS 5.3, Maiwei Safety Production Control Platform)
- [CVE-2023-31230](https://cve.now/CVE-2023-31230.md): WordPress Baidu Tongji generator Plugin \<= 1.0.2 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 7.1, Haoqisir Baidu Tongji generator)
- [CVE-2023-32123](https://cve.now/CVE-2023-32123.md): WordPress The7 Theme \<= 11.7.3 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 6.1, Dream-Theme The7)
- [CVE-2023-35877](https://cve.now/CVE-2023-35877.md): WordPress Extra User Details Plugin \<= 0.5 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 7.1, Vadym K. Extra User Details)
- [CVE-2023-39166](https://cve.now/CVE-2023-39166.md): WordPress tagDiv Composer Plugin \< 4.4 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 7.1, tagDiv Composer)
- [CVE-2023-6101](https://cve.now/CVE-2023-6101.md): Maiwei Safety Production Control Platform Intelligent Monitoring ha.html information disclosure (CVSS 5.3, Maiwei Safety Production Control Platform)
- [CVE-2023-6100](https://cve.now/CVE-2023-6100.md): Maiwei Safety Production Control Platform GetItemList information disclosure (CVSS 5.3, Maiwei Safety Production Control Platform)
- [CVE-2023-6099](https://cve.now/CVE-2023-6099.md): Shenzhen Youkate Industrial Facial Love Cloud Payment System Account SystemMng.ashx privileges management (CVSS 7.3, Shenzhen Youkate Industrial Facial Love Cloud Payment System)
- [CVE-2023-6098](https://cve.now/CVE-2023-6098.md): Cross-site Scripting on ICSSolution ICS Business Manager (CVSS 6.3, ICSSolution ICS Business Manager)
- [CVE-2023-6097](https://cve.now/CVE-2023-6097.md): SQL Injection on ICSSolution ICS Business Manager (CVSS 9.4, ICSSolution ICS Business Manager)
- [CVE-2023-40335](https://cve.now/CVE-2023-40335.md): WordPress Cleverwise Daily Quotes Plugin \<= 3.2 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Jeremy O'Connell Cleverwise Daily Quotes)
- [CVE-2023-46092](https://cve.now/CVE-2023-46092.md): WordPress Webmaster Tools Plugin \<= 2.0 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 7.1, LionScripts.com Webmaster Tools)
- [CVE-2023-5747](https://cve.now/CVE-2023-5747.md): Command injection via wave install file (CVSS 7.2, Hanwha Vision Co. PNV-A6081R)
- [CVE-2023-5037](https://cve.now/CVE-2023-5037.md): Authenticated Command Injection (CVSS 7.1, Hanwha Vision Co. A-Series, Q-Series, PNM-series Camera)
- [CVE-2023-4775](https://cve.now/CVE-2023-4775.md): Advanced iFrame \<= 2023.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, mdempfle Advanced iFrame)
- [CVE-2023-5741](https://cve.now/CVE-2023-5741.md): POWR \<= 2.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, powr Custom Form Builder, Contact Forms, Payment Forms, Sur…)
- [CVE-2023-46201](https://cve.now/CVE-2023-46201.md): WordPress Auto Login New User After Registration Plugin \<= 1.9.6 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 7.1, Jeff Sherk Auto Login New User After Registration)
- [CVE-2023-46634](https://cve.now/CVE-2023-46634.md): WordPress Custom My Account for Woocommerce Plugin \<= 2.1 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 7.1, phoeniixx Custom My Account for Woocommerce)
- [CVE-2023-47516](https://cve.now/CVE-2023-47516.md): WordPress Category Post List Widget Plugin \<= 2.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Stark Digital Category Post List Widget)
- [CVE-2023-47652](https://cve.now/CVE-2023-47652.md): WordPress Auto Affiliate Links Plugin \<= 6.4.2.4 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 7.1, Lucian Apostol Auto Affiliate Links)
- [CVE-2022-45835](https://cve.now/CVE-2022-45835.md): WordPress PhonePe Payment Solutions Plugin \<= 1.0.15 is vulnerable to Server Side Request Forgery (SSRF) (CVSS 5.8, PhonePe Payment Solutions)
- [CVE-2023-23684](https://cve.now/CVE-2023-23684.md): WordPress WPGraphQL Plugin \<= 1.14.5 is vulnerable to Server Side Request Forgery (SSRF) (CVSS 4.4, WPGraphQL · wp-graphql/wp-graphql)
- [CVE-2023-23800](https://cve.now/CVE-2023-23800.md): WordPress Shortcodes Ultimate Plugin \<= 5.12.6 is vulnerable to Server Side Request Forgery (SSRF) (CVSS 7.1, Vova Anokhin WP Shortcodes Plugin — Shortcodes Ultimate)
- [CVE-2023-46207](https://cve.now/CVE-2023-46207.md): WordPress Motors – Car Dealer & Classified Ads Plugin \<= 1.4.6 is vulnerable to Server Side Request Forgery (SSRF) (CVSS 4.1, StylemixThemes Motors – Car Dealer, Classifieds & Listing)
- [CVE-2023-41239](https://cve.now/CVE-2023-41239.md): WordPress PowerPress Podcasting Plugin \<= 11.0.6 is vulnerable to Server Side Request Forgery (SSRF) (CVSS 6.4, PowerPress Podcasting plugin by Blubrry)
- [CVE-2023-37978](https://cve.now/CVE-2023-37978.md): WordPress HTTP Headers Plugin \<= 1.18.11 is vulnerable to Server Side Request Forgery (SSRF) (CVSS 4.4, Dimitar Ivanov HTTP Headers)
- [CVE-2023-38515](https://cve.now/CVE-2023-38515.md): WordPress Church Admin Plugin \<= 3.7.56 is vulnerable to Server Side Request Forgery (SSRF) (CVSS 5.5, Andy Moyle Church Admin)
- [CVE-2023-34013](https://cve.now/CVE-2023-34013.md): WordPress Poll Maker Plugin \<= 4.6.2 is vulnerable to Server Side Request Forgery (SSRF) (CVSS 4.4, Poll Maker Team Poll Maker – Best WordPress Poll Plugin)
- [CVE-2023-47163](https://cve.now/CVE-2023-47163.md): Remarshal prior to v0.17.1 expands YAML alias nodes unlimitedly, hence Remarshal is vulnerable to Billion Laughs Attack. (no CVSS, Remarshal-project Remarshal · remarshal)
- [CVE-2023-31219](https://cve.now/CVE-2023-31219.md): WordPress Download Monitor Plugin \<= 4.8.1 is vulnerable to Server Side Request Forgery (SSRF) (CVSS 4.1, WPChill Download Monitor)
- [CVE-2023-35041](https://cve.now/CVE-2023-35041.md): WordPress Webpushr Plugin \<= 4.34.0 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 8.8, Webpushr Web Push Notifications Web Push Notifications – We…)
- [CVE-2023-38364](https://cve.now/CVE-2023-38364.md): IBM CICS TX Advanced cross-site scripting (CVSS 6.1, IBM CICS TX Advanced)
- [CVE-2023-38363](https://cve.now/CVE-2023-38363.md): IBM CICS TX information disclosure (CVSS 4.3, IBM CICS TX Advanced)
- [CVE-2023-32583](https://cve.now/CVE-2023-32583.md): WordPress WP All Backup Plugin \<= 2.4.3 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 6.3, Prashant Walke WP All Backup)
- [CVE-2023-32588](https://cve.now/CVE-2023-32588.md): WordPress Post State Tags Plugin \<= 2.0.6 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, BRANDbrilliance Post State Tags)
- [CVE-2023-33207](https://cve.now/CVE-2023-33207.md): WordPress Stop Referrer Spam Plugin \<= 1.3.0 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Krzysztof Wielogórski Stop Referrer Spam)
- [CVE-2023-34378](https://cve.now/CVE-2023-34378.md): WordPress WP Hide Post Plugin \<= 2.0.10 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, scriptburn.com WP Hide Post)
- [CVE-2023-34384](https://cve.now/CVE-2023-34384.md): WordPress Kebo Twitter Feed Plugin \<= 1.5.12 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, Kebo Twitter Feed)
- [CVE-2023-47669](https://cve.now/CVE-2023-47669.md): WordPress Profile Builder Plugin \<= 3.10.3 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, Cozmoslabs User Profile Builder – Beautiful User Registrati…)
- [CVE-2023-46618](https://cve.now/CVE-2023-46618.md): WordPress Category SEO Meta Tags Plugin \<= 2.5 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Bala Krishna, Sergey Yakovlev Category SEO Meta Tags)
- [CVE-2023-46619](https://cve.now/CVE-2023-46619.md): WordPress Spider Facebook Plugin \<= 1.0.15 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, WebDorado WDSocialWidgets)
- [CVE-2023-46620](https://cve.now/CVE-2023-46620.md): WordPress DeepL Pro API translation Plugin \<= 2.3.9.1 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Fluenx DeepL API translation plugin)
- [CVE-2023-46625](https://cve.now/CVE-2023-46625.md): WordPress Autolinks Manager Plugin \<= 1.10.04 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, DAEXT Autolinks Manager)
- [CVE-2023-46629](https://cve.now/CVE-2023-46629.md): WordPress Remove Add to Cart WooCommerce Plugin \<= 1.4.4 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, themelocation Remove Add to Cart WooCommerce)
- [CVE-2023-46636](https://cve.now/CVE-2023-46636.md): WordPress Custom Header Images Plugin \<= 1.2.1 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, David Stöckl Custom Header Images)
- [CVE-2023-46638](https://cve.now/CVE-2023-46638.md): WordPress WCP OpenWeather Plugin \<= 2.5.0 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Webcodin WCP OpenWeather)
- [CVE-2023-47230](https://cve.now/CVE-2023-47230.md): WordPress Contact Forms by Cimatti Plugin \<= 1.6.0 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, Cimatti Consulting WordPress Contact Forms by Cimatti)
- [CVE-2023-26543](https://cve.now/CVE-2023-26543.md): WordPress WP Meteor Page Speed Optimization Topping Plugin \<= 3.1.4 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Aleksandr Guidrevitch WP Meteor Website Speed Optimization…)
- [CVE-2023-46014](https://cve.now/CVE-2023-46014.md): SQL Injection vulnerability in hospitalLogin.php in Code-Projects Blood Bank 1.0 allows attackers to run arbitrary SQL commands via 'hemail' (no CVSS)
- [CVE-2023-46015](https://cve.now/CVE-2023-46015.md): Cross Site Scripting (XSS) vulnerability in index.php in Code-Projects Blood Bank 1.0 allows attackers to run arbitrary code via 'msg' param (no CVSS)
- [CVE-2023-46016](https://cve.now/CVE-2023-46016.md): Cross Site Scripting (XSS) in abs.php in Code-Projects Blood Bank 1.0 allows attackers to run arbitrary code via the 'search' parameter in t (no CVSS)
- [CVE-2023-46017](https://cve.now/CVE-2023-46017.md): SQL Injection vulnerability in receiverLogin.php in Code-Projects Blood Bank 1.0 allows attackers to run arbitrary SQL commands via 'remail' (no CVSS)
- [CVE-2023-46018](https://cve.now/CVE-2023-46018.md): SQL injection vulnerability in receiverReg.php in Code-Projects Blood Bank 1.0 \\allows attackers to run arbitrary SQL commands via 'remail' (no CVSS)
- [CVE-2023-46019](https://cve.now/CVE-2023-46019.md): Cross Site Scripting (XSS) vulnerability in abs.php in Code-Projects Blood Bank 1.0 allows attackers to run arbitrary code via the 'error' p (no CVSS)
- [CVE-2023-46020](https://cve.now/CVE-2023-46020.md): Cross Site Scripting (XSS) in updateprofile.php in Code-Projects Blood Bank 1.0 allows attackers to run arbitrary code via the 'rename', 're (no CVSS)
- [CVE-2023-46021](https://cve.now/CVE-2023-46021.md): SQL Injection vulnerability in cancel.php in Code-Projects Blood Bank 1.0 allows attackers to run arbitrary commands via the 'reqid' paramet (no CVSS)
- [CVE-2023-47346](https://cve.now/CVE-2023-47346.md): Buffer Overflow vulnerability in free5gc 3.3.0, UPF 1.2.0, and SMF 1.2.0 allows attackers to cause a denial of service via crafted PFCP mess (no CVSS)
- [CVE-2023-47801](https://cve.now/CVE-2023-47801.md): An issue was discovered in Click Studios Passwordstate before 9811. (no CVSS)
- [CVE-2023-48058](https://cve.now/CVE-2023-48058.md): Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/task/run (CVSS 8.8)
- [CVE-2023-48060](https://cve.now/CVE-2023-48060.md): Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/task/add (CVSS 8.8)
- [CVE-2023-48063](https://cve.now/CVE-2023-48063.md): An issue was discovered in dreamer\_cms 4.1.3. (no CVSS)
- [CVE-2023-48068](https://cve.now/CVE-2023-48068.md): DedeCMS v6.2 was discovered to contain a Cross-site Scripting (XSS) vulnerability via spec\_add.php. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-11-13
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.