Total
424956 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2023-0505 | 1 Hasthemes | 1 Ever Compare | 2026-06-17 | N/A | 4.3 MEDIUM |
| The Ever Compare WordPress plugin through 1.2.3 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack | |||||
| CVE-2023-0504 | 1 Hasthemes | 1 Ht Politic | 2026-06-17 | N/A | 4.3 MEDIUM |
| The HT Politic WordPress plugin before 2.3.8 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack | |||||
| CVE-2023-0503 | 1 Hasthemes | 1 Free Woocommerce Theme 99fy Extension | 2026-06-17 | N/A | 4.3 MEDIUM |
| The Free WooCommerce Theme 99fy Extension WordPress plugin before 1.2.8 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack | |||||
| CVE-2023-0502 | 1 Hasthemes | 1 Wp News | 2026-06-17 | N/A | 6.5 MEDIUM |
| The WP News WordPress plugin through 1.1.9 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack | |||||
| CVE-2023-0501 | 1 Hasthemes | 1 Wp Insurance | 2026-06-17 | N/A | 6.5 MEDIUM |
| The WP Insurance WordPress plugin before 2.1.4 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack | |||||
| CVE-2023-0500 | 1 Hasthemes | 1 Wp Film Studio | 2026-06-17 | N/A | 6.5 MEDIUM |
| The WP Film Studio WordPress plugin before 1.3.5 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack | |||||
| CVE-2023-0499 | 1 Hasthemes | 1 Quickswish | 2026-06-17 | N/A | 4.3 MEDIUM |
| The QuickSwish WordPress plugin before 1.1.0 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack | |||||
| CVE-2023-0498 | 1 Hasthemes | 1 Wp Education | 2026-06-17 | N/A | 4.3 MEDIUM |
| The WP Education WordPress plugin before 1.2.7 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack | |||||
| CVE-2023-0497 | 1 Hasthemes | 1 Ht Portfolio | 2026-06-17 | N/A | 4.3 MEDIUM |
| The HT Portfolio WordPress plugin before 1.1.6 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack | |||||
| CVE-2023-0496 | 1 Hasthemes | 1 Ht Event | 2026-06-17 | N/A | 4.3 MEDIUM |
| The HT Event WordPress plugin before 1.4.6 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack | |||||
| CVE-2023-0495 | 1 Hasthemes | 1 Ht Slider For Elementor | 2026-06-17 | N/A | 4.3 MEDIUM |
| The HT Slider For Elementor WordPress plugin before 1.4.0 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack | |||||
| CVE-2023-0494 | 3 Fedoraproject, Redhat, X.org | 18 Fedora, Enterprise Linux, Enterprise Linux Aus and 15 more | 2026-06-17 | N/A | 7.8 HIGH |
| A vulnerability was found in X.Org. This issue occurs due to a dangling pointer in DeepCopyPointerClasses that can be exploited by ProcXkbSetDeviceInfo() and ProcXkbGetDeviceInfo() to read and write into freed memory. This can lead to local privilege elevation on systems where the X server runs privileged and remote code execution for ssh X forwarding sessions. | |||||
| CVE-2023-0493 | 1 Btcpayserver | 1 Btcpay Server | 2026-06-17 | N/A | 5.3 MEDIUM |
| Improper Neutralization of Equivalent Special Elements in GitHub repository btcpayserver/btcpayserver prior to 1.7.5. | |||||
| CVE-2023-0492 | 1 Gsplugins | 1 Gs Products Slider | 2026-06-17 | N/A | 5.4 MEDIUM |
| The GS Products Slider for WooCommerce WordPress plugin before 1.5.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks | |||||
| CVE-2023-0491 | 1 Schedulicity | 1 Schedulicity | 2026-06-17 | N/A | 5.4 MEDIUM |
| The Schedulicity WordPress plugin through 2.21 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. | |||||
| CVE-2023-0490 | 1 F\(x\) Toc Project | 1 F\(x\) Toc | 2026-06-17 | N/A | 5.4 MEDIUM |
| The f(x) TOC WordPress plugin through 1.1.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. | |||||
| CVE-2023-0489 | 1 Slideonline Project | 1 Sideonline | 2026-06-17 | N/A | 5.4 MEDIUM |
| The SlideOnline WordPress plugin through 1.2.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks | |||||
| CVE-2023-0488 | 2 Pyload, Pyload-ng Project | 2 Pyload, Pyload-ng | 2026-06-17 | N/A | 5.4 MEDIUM |
| Cross-site Scripting (XSS) - Stored in GitHub repository pyload/pyload prior to 0.5.0b3.dev42. | |||||
| CVE-2023-0487 | 1 Premio | 1 My Sticky Elements | 2026-06-17 | N/A | 7.2 HIGH |
| The My Sticky Elements WordPress plugin before 2.0.9 does not properly sanitise and escape a parameter before using it in a SQL statement when deleting messages, leading to a SQL injection exploitable by high privilege users such as admin | |||||
| CVE-2023-0486 | 1 Vitalpbx | 1 Vitalpbx | 2026-06-17 | N/A | 6.1 MEDIUM |
| VitalPBX version 3.2.3-8 allows an unauthenticated external attacker to obtain the instance's administrator account via a malicious link. This is possible because the application is vulnerable to XSS. | |||||