# CVEs published 2023-11-18

41 CVEs were published on November 18, 2023: 0 critical, 3 high. Days are UTC.

- [CVE-2023-28780](https://cve.now/CVE-2023-28780.md): WordPress Yoast SEO: Local Plugin \<= 14.8 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 6.5, Yoast Local Premium)
- [CVE-2023-31075](https://cve.now/CVE-2023-31075.md): WordPress Easy Hide Login Plugin \<= 1.0.8 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, Arshid Easy Hide Login)
- [CVE-2023-31089](https://cve.now/CVE-2023-31089.md): WordPress Video XML Sitemap Generator Plugin \<= 1.0.0 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Tradebooster Video XML Sitemap Generator)
- [CVE-2023-32245](https://cve.now/CVE-2023-32245.md): WordPress Essential Addons for Elementor Pro Plugin \<= 5.4.8 is vulnerable to Server Side Request Forgery (SSRF) (CVSS 5.4, WPDeveloper Essential Addons for Elementor Pro)
- [CVE-2023-32504](https://cve.now/CVE-2023-32504.md): WordPress Wise Chat Plugin \<= 3.1.3 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, Kainex Wise Chat)
- [CVE-2023-32514](https://cve.now/CVE-2023-32514.md): WordPress Google Site Verification plugin using Meta Tag Plugin \<= 1.2 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, Himanshu Parashar Google Site Verification plugin using Met…)
- [CVE-2023-25985](https://cve.now/CVE-2023-25985.md): WordPress WordPress Tooltips Plugin \<= 8.2.5 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Tomas | Docs | FAQ | Premium Support WordPress Tooltips)
- [CVE-2023-41129](https://cve.now/CVE-2023-41129.md): WordPress Patreon WordPress Plugin \<= 1.8.6 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Patreon WordPress)
- [CVE-2023-47243](https://cve.now/CVE-2023-47243.md): WordPress MSHOP MY SITE Plugin \<= 1.1.6 is vulnerable to Broken Access Control (CVSS 5.4, CodeMShop 코드엠샵 마이사이트 – MSHOP MY SITE)
- [CVE-2023-47519](https://cve.now/CVE-2023-47519.md): WordPress WooCommerce Product Table Lite Plugin \<= 2.6.2 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, WC Product Table WooCommerce Product Table Lite)
- [CVE-2023-47531](https://cve.now/CVE-2023-47531.md): WordPress Droit Dark Mode Plugin \<= 1.1.2 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, DroitThemes Droit Dark Mode)
- [CVE-2023-47551](https://cve.now/CVE-2023-47551.md): WordPress Donations Made Easy – Smart Donations Plugin \<= 4.0.12 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, RedNao Donations Made Easy – Smart Donations)
- [CVE-2023-47552](https://cve.now/CVE-2023-47552.md): WordPress Image Hover Effects Plugin \<= 5.5 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, Labib Ahmed Image Hover Effects – WordPress Plugin)
- [CVE-2023-47553](https://cve.now/CVE-2023-47553.md): WordPress UserHeat Plugin Plugin \<= 1.1.6 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, User Local UserHeat Plugin)
- [CVE-2023-47556](https://cve.now/CVE-2023-47556.md): WordPress Device Theme Switcher Plugin \<= 3.0.2 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, James Mehorter Device Theme Switcher)
- [CVE-2023-47644](https://cve.now/CVE-2023-47644.md): WordPress ProfileGrid Plugin \<= 5.6.6 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, ProfileGrid – User Profiles, Memberships, Groups and Commun…)
- [CVE-2023-47649](https://cve.now/CVE-2023-47649.md): WordPress Best Restaurant Menu by PriceListo Plugin \<= 1.3.1 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, Best Restaurant Menu by PriceListo)
- [CVE-2023-47650](https://cve.now/CVE-2023-47650.md): WordPress Add Local Avatar Plugin \<= 12.1 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 6.5, Peter Sterling Add Local Avatar)
- [CVE-2023-47651](https://cve.now/CVE-2023-47651.md): WordPress WP Links Page Plugin \<= 4.9.4 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Robert Macchi WP Links Page)
- [CVE-2023-47655](https://cve.now/CVE-2023-47655.md): WordPress ANAC XML Bandi di Gara Plugin \<= 7.5 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, Marco Milesi ANAC XML Bandi di Gara)
- [CVE-2023-47664](https://cve.now/CVE-2023-47664.md): WordPress Plainview Protect Passwords Plugin \<= 1.4 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 6.5, edward\_plainview Plainview Protect Passwords)
- [CVE-2023-47666](https://cve.now/CVE-2023-47666.md): WordPress Code Snippets Plugin \<= 3.5.0 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Code Snippets Pro Code Snippets)
- [CVE-2023-47667](https://cve.now/CVE-2023-47667.md): WordPress WP Full Stripe Free plugin \<= 7.0.16 - Cross Site Request Forgery (CSRF) vulnerability on every Setting Save (CVSS 4.3, Mammothology WP Full Stripe Free)
- [CVE-2023-47670](https://cve.now/CVE-2023-47670.md): WordPress Korea SNS Plugin \<= 1.6.3 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Jongmyoung Kim Korea SNS)
- [CVE-2023-47671](https://cve.now/CVE-2023-47671.md): WordPress Vertical scroll recent post Plugin \<= 14.0 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, Gopi Ramasamy Vertical scroll recent post)
- [CVE-2023-47672](https://cve.now/CVE-2023-47672.md): WordPress WP Category Post List Widget Plugin \<= 2.0.3 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Swashata WP Category Post List Widget)
- [CVE-2023-47685](https://cve.now/CVE-2023-47685.md): WordPress Preloader Matrix Plugin \<= 2.0.1 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, Lukman Nakib Preloader Matrix)
- [CVE-2023-38361](https://cve.now/CVE-2023-38361.md): IBM CICS TX Advanced information disclosure (CVSS 5.9, IBM CICS TX Advanced)
- [CVE-2023-40363](https://cve.now/CVE-2023-40363.md): IBM InfoSphere Information Server privilege escalation (CVSS 8.1, IBM InfoSphere Information Server)
- [CVE-2023-6187](https://cve.now/CVE-2023-6187.md): Paid Memberships Pro \<= 2.12.3 - Authenticated (Subscriber+) Arbitrary File Upload (CVSS 7.5, strangerstudios Paid Memberships Pro – Content Restriction,…)
- [CVE-2023-4214](https://cve.now/CVE-2023-4214.md): AppPresser \<= 4.2.5 - Insecure Password Reset Mechanism (CVSS 8.1, scottopolis AppPresser – Mobile App Framework)
- [CVE-2023-40809](https://cve.now/CVE-2023-40809.md): OpenCRX version 5.2.0 is vulnerable to HTML injection via the Activity Search Criteria-Activity Number. (CVSS 6.1, org.opencrx:opencrx-core-models)
- [CVE-2023-40810](https://cve.now/CVE-2023-40810.md): OpenCRX version 5.2.0 is vulnerable to HTML injection via Product Name Field. (no CVSS, org.opencrx:opencrx-core-models)
- [CVE-2023-40812](https://cve.now/CVE-2023-40812.md): OpenCRX version 5.2.0 is vulnerable to HTML injection via the Accounts Group Name Field. (no CVSS, org.opencrx:opencrx-core-models)
- [CVE-2023-40813](https://cve.now/CVE-2023-40813.md): OpenCRX version 5.2.0 is vulnerable to HTML injection via Activity Saved Search Creation. (no CVSS, org.opencrx:opencrx-core-models)
- [CVE-2023-40814](https://cve.now/CVE-2023-40814.md): OpenCRX version 5.2.0 is vulnerable to HTML injection via the Accounts Name Field. (no CVSS, org.opencrx:opencrx-core-models)
- [CVE-2023-40815](https://cve.now/CVE-2023-40815.md): OpenCRX version 5.2.0 is vulnerable to HTML injection via the Category Creation Name Field. (no CVSS, org.opencrx:opencrx-core-models)
- [CVE-2023-40816](https://cve.now/CVE-2023-40816.md): OpenCRX version 5.2.0 is vulnerable to HTML injection via Activity Milestone Name Field. (no CVSS, org.opencrx:opencrx-core-models)
- [CVE-2023-40817](https://cve.now/CVE-2023-40817.md): OpenCRX version 5.2.0 is vulnerable to HTML injection via the Product Configuration Name Field. (no CVSS, org.opencrx:opencrx-core-models)
- [CVE-2023-48017](https://cve.now/CVE-2023-48017.md): Dreamer\_cms 4.1.3 is vulnerable to Cross Site Request Forgery (CSRF) via Add permissions to CSRF in Permission Management. (no CVSS)
- [CVE-2023-48736](https://cve.now/CVE-2023-48736.md): In International Color Consortium DemoIccMAX 3e7948b, CIccCLUT::Interp2d in IccTagLut.cpp in libSampleICC.a has an out-of-bounds read. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-11-18
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.