Total
47493 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2023-32802 | 1 Woocommerce | 1 Woocommerce Pre-orders | 2026-06-17 | N/A | 7.1 HIGH |
| Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WooCommerce WooCommerce Pre-Orders plugin <= 1.9.0 versions. | |||||
| CVE-2023-32801 | 1 Woocommerce | 1 Composite Products | 2026-06-17 | N/A | 7.1 HIGH |
| Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WooCommerce Composite Products plugin <= 8.7.5 versions. | |||||
| CVE-2023-32800 | 1 Rankmath | 1 Seo Pro | 2026-06-17 | N/A | 7.1 HIGH |
| Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in One Rank Math SEO PRO plugin <= 3.0.35 versions. | |||||
| CVE-2023-32797 | 1 I13websolution | 1 Video Carousel Slider With Lightbox | 2026-06-17 | N/A | 7.1 HIGH |
| Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in I Thirteen Web Solution video carousel slider with lightbox plugin <= 1.0.22 versions. | |||||
| CVE-2023-32796 | 1 Mingocommerce | 1 Woocommerce Product Enquiry | 2026-06-17 | N/A | 7.1 HIGH |
| Unauth. Stored Cross-Site Scripting (XSS) vulnerability in MingoCommerce WooCommerce Product Enquiry plugin <= 2.3.4 versions. | |||||
| CVE-2023-32793 | 1 Woocommerce | 1 Woocommerce Pre-orders | 2026-06-17 | N/A | 6.5 MEDIUM |
| Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in WooCommerce WooCommerce Pre-Orders plugin <= 2.0.0 versions. | |||||
| CVE-2023-32790 | 1 Nxlog | 1 Nxlog Manager | 2026-06-17 | N/A | 4.6 MEDIUM |
| Cross-Site Scripting (XSS) vulnerability in NXLog Manager 5.6.5633 version. This vulnerability allows an attacker to inject a malicious JavaScript payload into the 'Full Name' field during a user edit, due to improper sanitization of the input parameter. | |||||
| CVE-2023-32766 | 1 Gitpod | 1 Gitpod | 2026-06-17 | N/A | 6.1 MEDIUM |
| Gitpod before 2022.11.3 allows XSS because redirection can occur for some protocols outside of the trusted set of three (vscode: vscode-insiders: jetbrains-gateway:). | |||||
| CVE-2023-32751 | 1 Pydio | 1 Cells | 2026-06-17 | N/A | 5.4 MEDIUM |
| Pydio Cells through 4.1.2 allows XSS. Pydio Cells implements the download of files using presigned URLs which are generated using the Amazon AWS SDK for JavaScript [1]. The secrets used to sign these URLs are hardcoded and exposed through the JavaScript files of the web application. Therefore, it is possible to generate valid signatures for arbitrary download URLs. By uploading an HTML file and modifying the download URL to serve the file inline instead of as an attachment, any included JavaScript code is executed when the URL is opened in a browser, leading to a cross-site scripting vulnerability. | |||||
| CVE-2023-32746 | 1 Woocommerce | 1 Woocommerce Brands | 2026-06-17 | N/A | 6.5 MEDIUM |
| Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in WooCommerce WooCommerce Brands plugin <= 1.6.45 versions. | |||||
| CVE-2023-32742 | 1 Veronalabs | 1 Wp Sms | 2026-06-17 | N/A | 7.1 HIGH |
| Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in VeronaLabs WP SMS plugin <= 6.1.4 versions. | |||||
| CVE-2023-32740 | 1 Kunalnagar | 1 Custom 404 Pro | 2026-06-17 | N/A | 5.8 MEDIUM |
| Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Kunal Nagar Custom 404 Pro plugin <= 3.8.1 versions. | |||||
| CVE-2023-32738 | 1 Xtendify | 1 Eonet Manual User Approve | 2026-06-17 | N/A | 5.9 MEDIUM |
| Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Alkaweb Eonet Manual User Approve plugin <= 2.1.3 versions. | |||||
| CVE-2023-32721 | 1 Zabbix | 1 Zabbix | 2026-06-17 | N/A | 7.6 HIGH |
| A stored XSS has been found in the Zabbix web application in the Maps element if a URL field is set with spaces before URL. | |||||
| CVE-2023-32715 | 1 Splunk | 1 Splunk App For Lookup File Editing | 2026-06-17 | N/A | 4.7 MEDIUM |
| In the Splunk App for Lookup File Editing versions below 4.0.1, a user can insert potentially malicious JavaScript code into the app, which causes that code to run on the user’s machine. The app itself does not contain the potentially malicious JavaScript code. The vulnerability requires the attacker to phish the victim by tricking them into initiating a request within their browser, and requires additional user interaction to trigger. The attacker cannot exploit the vulnerability at will. | |||||
| CVE-2023-32711 | 1 Splunk | 1 Splunk | 2026-06-17 | N/A | 5.4 MEDIUM |
| In Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, a Splunk dashboard view lets a low-privileged user exploit a vulnerability in the Bootstrap web framework (CVE-2019-8331) and build a stored cross-site scripting (XSS) payload. | |||||
| CVE-2023-32693 | 1 Decidim | 1 Decidim | 2026-06-17 | N/A | 8.1 HIGH |
| Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participation website. The external link feature is susceptible to cross-site scripting. This allows a remote attacker to execute JavaScript code in the context of a currently logged-in user. An attacker could use this vulnerability to make other users endorse or support proposals they have no intention of supporting or endorsing. The problem was patched in versions 0.27.3 and 0.26.7. | |||||
| CVE-2023-32686 | 1 Kiwitcms | 1 Kiwi Tcms | 2026-06-17 | N/A | 8.1 HIGH |
| Kiwi TCMS is an open source test management system for both manual and automated testing. Kiwi TCMS allows users to upload attachments to test plans, test cases, etc. Earlier versions of Kiwi TCMS had introduced upload validators in order to prevent potentially dangerous files from being uploaded. The upload validation checks were not robust enough which left the possibility of an attacker to circumvent them and upload a potentially dangerous file. Exploiting this flaw, a combination of files could be uploaded so that they work together to circumvent the existing Content-Security-Policy and allow execution of arbitrary JavaScript in the browser. This issue has been patched in version 12.3. | |||||
| CVE-2023-32685 | 1 Kanboard | 1 Kanboard | 2026-06-17 | N/A | 4.4 MEDIUM |
| Kanboard is project management software that focuses on the Kanban methodology. Due to improper handling of elements under the `contentEditable` element, maliciously crafted clipboard content can inject arbitrary HTML tags into the DOM. A low-privileged attacker with permission to attach a document on a vulnerable Kanboard instance can trick the victim into pasting malicious screenshot data and achieve cross-site scripting if CSP is improperly configured. This issue has been patched in version 1.2.29. | |||||
| CVE-2023-32671 | 1 Buddyboss | 1 Buddyboss | 2026-06-17 | N/A | 6.3 MEDIUM |
| A stored XSS vulnerability has been found on BuddyBoss Platform affecting version 2.2.9. This vulnerability allows an attacker to store a malicious javascript payload via POST request when sending an invitation. | |||||