# Vulnerabilities published in 2023


- [CVE-2023-52194](https://insights.sbomify.com/CVE-2023-52194/): WordPress oEmbed Gist Plugin <= 4.9.1 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-52193](https://insights.sbomify.com/CVE-2023-52193/): WordPress Page Builder: Live Composer Plugin <= 1.5.23 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-52192](https://insights.sbomify.com/CVE-2023-52192/): WordPress Keap Official Opt-in Forms Plugin <= 1.0.11 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-52191](https://insights.sbomify.com/CVE-2023-52191/): WordPress Infogram Plugin <= 1.6.1 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-52190](https://insights.sbomify.com/CVE-2023-52190/): WordPress Coupon Referral Program Plugin <= 1.7.2 is vulnerable to Sensitive Data Exposure (high 7.5)
- [CVE-2023-52189](https://insights.sbomify.com/CVE-2023-52189/): WordPress Ideal Interactive Map Plugin <= 1.2.4 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-52188](https://insights.sbomify.com/CVE-2023-52188/): WordPress Footer Putter Plugin <= 1.17 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-52187](https://insights.sbomify.com/CVE-2023-52187/): WordPress Image Source Control Plugin <= 2.17.0 is vulnerable to Sensitive Data Exposure (medium 5.3)
- [CVE-2023-52186](https://insights.sbomify.com/CVE-2023-52186/): WordPress WooCommerce Product Vendors plugin <= 2.2.2 - Unauthenticated Broken Access Control vulnerability (medium 5.3)
- [CVE-2023-52185](https://insights.sbomify.com/CVE-2023-52185/): WordPress Everest Backup Plugin <= 2.1.9 is vulnerable to Sensitive Data Exposure (medium 5.3)
- [CVE-2023-52184](https://insights.sbomify.com/CVE-2023-52184/): WordPress WP Job Portal Plugin <= 2.0.6 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-52183](https://insights.sbomify.com/CVE-2023-52183/): WordPress WordPress Backup & Migration plugin <= 1.4.3 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2023-52182](https://insights.sbomify.com/CVE-2023-52182/): WordPress ARI Stream Quiz Plugin <= 1.3.0 is vulnerable to PHP Object Injection (critical 9.9)
- [CVE-2023-52181](https://insights.sbomify.com/CVE-2023-52181/): WordPress Theme per user Plugin <= 1.0.1 is vulnerable to PHP Object Injection (critical 10.0)
- [CVE-2023-52180](https://insights.sbomify.com/CVE-2023-52180/): WordPress Recipe Maker For Your Food Blog from Zip Recipes Plugin <= 8.1.0 is vulnerable to SQL Injection (high 7.6)
- [CVE-2023-5218](https://insights.sbomify.com/CVE-2023-5218/): Use after free in Chrome (high 8.8)
- [CVE-2023-52179](https://insights.sbomify.com/CVE-2023-52179/): WordPress Product Expiry for WooCommerce plugin <= 2.5 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2023-52178](https://insights.sbomify.com/CVE-2023-52178/): WordPress WP Affiliate Disclosure Plugin <= 1.2.7 is vulnerable to Cross-Site Scripting (XSS) (medium 6.5)
- [CVE-2023-52177](https://insights.sbomify.com/CVE-2023-52177/): WordPress Integrate Google Drive plugin <= 1.3.3 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2023-52176](https://insights.sbomify.com/CVE-2023-52176/): WordPress Malware Scanner plugin <= 4.7.1 - IP Restriction Bypass vulnerability (medium 5.3)
- [CVE-2023-52175](https://insights.sbomify.com/CVE-2023-52175/): WordPress Auto Amazon Links Plugin <= 5.1.1 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-52174](https://insights.sbomify.com/CVE-2023-52174/): Memory corruption in xnview:xnview classic (critical 9.8)
- [CVE-2023-52173](https://insights.sbomify.com/CVE-2023-52173/): Memory corruption in xnview:xnview classic (critical 9.8)
- [CVE-2023-5217](https://insights.sbomify.com/CVE-2023-5217/): Google Chromium libvpx Heap Buffer Overflow (high 8.8, exploited in the wild)
- [CVE-2023-52169](https://insights.sbomify.com/CVE-2023-52169/): The NtfsHandler.cpp NTFS handler in 7-Zip before 24.01 (for 7zz) contains an out-of-bounds read that allows an attacker to read beyond the intended buffer. (high 8.2)
- [CVE-2023-52168](https://insights.sbomify.com/CVE-2023-52168/): The NtfsHandler.cpp NTFS handler in 7-Zip before 24.01 (for 7zz) contains a heap-based buffer overflow that allows an attacker to overwrite (high 8.4)
- [CVE-2023-52164](https://insights.sbomify.com/CVE-2023-52164/): access_device.cgi on Digiever DS-2105 Pro 3.1.0.71-11 devices allows arbitrary file read. (medium 5.1)
- [CVE-2023-52163](https://insights.sbomify.com/CVE-2023-52163/): Digiever DS-2105 Pro Missing Authorization (high 8.8, exploited in the wild)
- [CVE-2023-52162](https://insights.sbomify.com/CVE-2023-52162/): Mercusys MW325R EU V3 (Firmware MW325R(EU)_V3_1.11.0 Build 221019) is vulnerable to a stack-based buffer overflow, which could allow an atta (medium 6.7)
- [CVE-2023-52161](https://insights.sbomify.com/CVE-2023-52161/): Auth bypass in intel:inet wireless daemon (high 7.5)
- [CVE-2023-52160](https://insights.sbomify.com/CVE-2023-52160/): Auth bypass in debian:debian linux (medium 6.5)
- [CVE-2023-52159](https://insights.sbomify.com/CVE-2023-52159/): Memory corruption in bizdelnick:gross (high 7.5)
- [CVE-2023-52155](https://insights.sbomify.com/CVE-2023-52155/): SQL injection in sigb:pmb (high 7.2)
- [CVE-2023-52154](https://insights.sbomify.com/CVE-2023-52154/): File upload in sigb:pmb (high 7.2)
- [CVE-2023-52153](https://insights.sbomify.com/CVE-2023-52153/): SQL injection in sigb:pmb (critical 9.8)
- [CVE-2023-52152](https://insights.sbomify.com/CVE-2023-52152/): Memory corruption in cybergarage:mupnp for c (high 7.5)
- [CVE-2023-52151](https://insights.sbomify.com/CVE-2023-52151/): WordPress Uncanny Automator Plugin <= 5.1.0.2 is vulnerable to Sensitive Data Exposure (medium 5.3)
- [CVE-2023-52150](https://insights.sbomify.com/CVE-2023-52150/): WordPress Dynamic Content for Elementor Plugin < 2.12.5 is vulnerable to Cross Site Request Forgery (CSRF) (high 8.8)
- [CVE-2023-5215](https://insights.sbomify.com/CVE-2023-5215/): Libnbd: crash or misbehaviour when nbd server returns an unexpected block size (medium 5.3)
- [CVE-2023-52149](https://insights.sbomify.com/CVE-2023-52149/): WordPress Floating Button Plugin <= 6.0 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-52148](https://insights.sbomify.com/CVE-2023-52148/): WordPress Affiliates Manager Plugin <= 2.9.30 is vulnerable to Sensitive Data Exposure (medium 5.3)
- [CVE-2023-52147](https://insights.sbomify.com/CVE-2023-52147/): Information disclosure in All In One WP Security & Firewall (low 3.7)
- [CVE-2023-52146](https://insights.sbomify.com/CVE-2023-52146/): WordPress 404 Solution Plugin <= 2.33.0 is vulnerable to Sensitive Data Exposure (medium 5.3)
- [CVE-2023-52145](https://insights.sbomify.com/CVE-2023-52145/): WordPress Republish Old Posts Plugin <= 1.21 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-52144](https://insights.sbomify.com/CVE-2023-52144/): WordPress Product Feed Manager plugin <= 7.3.15 - Directory Traversal vulnerability (medium 5.5)
- [CVE-2023-52143](https://insights.sbomify.com/CVE-2023-52143/): WordPress WP Stripe Checkout Plugin <= 1.2.2.37 is vulnerable to Sensitive Data Exposure (high 7.5)
- [CVE-2023-52142](https://insights.sbomify.com/CVE-2023-52142/): WordPress Events Shortcodes & Templates For The Events Calendar Plugin <= 2.3.1 is vulnerable to SQL Injection (high 7.6)
- [CVE-2023-5214](https://insights.sbomify.com/CVE-2023-5214/): CVE-2023-5214 - Privilege Escalation in Puppet Bolt (medium 6.5)
- [CVE-2023-52139](https://insights.sbomify.com/CVE-2023-52139/): Misskey vulnerable to improper authorization when accessing with third-party application (critical 9.1)
- [CVE-2023-52138](https://insights.sbomify.com/CVE-2023-52138/): Path traversal via crafted cpio archives in Engrampa archivers (high 8.2)
- [CVE-2023-52137](https://insights.sbomify.com/CVE-2023-52137/): GitHub Action tj-actions/verify-changed-files is vulnerable to command injection in output filenames (high 7.7)
- [CVE-2023-52136](https://insights.sbomify.com/CVE-2023-52136/): WordPress Custom Twitter Feeds (Tweets Widget) Plugin <= 2.1.2 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-52135](https://insights.sbomify.com/CVE-2023-52135/): WordPress WS Form LITE Plugin <= 1.9.170 is vulnerable to SQL Injection (high 7.6)
- [CVE-2023-52134](https://insights.sbomify.com/CVE-2023-52134/): WordPress GEO my WordPress Plugin <= 4.0.2 is vulnerable to SQL Injection (high 7.6)
- [CVE-2023-52133](https://insights.sbomify.com/CVE-2023-52133/): WordPress Most And Least Read Posts Widget Plugin <= 2.5.16 is vulnerable to SQL Injection (high 8.5)
- [CVE-2023-52132](https://insights.sbomify.com/CVE-2023-52132/): WordPress WP Adminify Plugin <= 3.1.6 is vulnerable to SQL Injection (high 7.6)
- [CVE-2023-52131](https://insights.sbomify.com/CVE-2023-52131/): WordPress Page Generator Plugin <= 1.7.1 is vulnerable to SQL Injection (high 7.6)
- [CVE-2023-52130](https://insights.sbomify.com/CVE-2023-52130/): WordPress Affiliates Manager Plugin <= 2.9.31 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-52129](https://insights.sbomify.com/CVE-2023-52129/): WordPress teachPress Plugin <= 9.0.4 is vulnerable to Cross Site Request Forgery (CSRF) (medium 6.3)
- [CVE-2023-52128](https://insights.sbomify.com/CVE-2023-52128/): WordPress White Label Plugin <= 2.9.0 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-52127](https://insights.sbomify.com/CVE-2023-52127/): WordPress WPC Product Bundles for WooCommerce Plugin <= 7.3.1 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-52126](https://insights.sbomify.com/CVE-2023-52126/): WordPress Send Users Email Plugin <= 1.4.3 is vulnerable to Sensitive Data Exposure (medium 5.3)
- [CVE-2023-52125](https://insights.sbomify.com/CVE-2023-52125/): WordPress iFrame Plugin <= 4.8 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-52124](https://insights.sbomify.com/CVE-2023-52124/): WordPress WP Tabs Plugin <= 2.2.0 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-52123](https://insights.sbomify.com/CVE-2023-52123/): WordPress Strong Testimonials Plugin <= 3.1.10 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-52122](https://insights.sbomify.com/CVE-2023-52122/): WordPress Simple Job Board Plugin <= 2.10.6 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-52121](https://insights.sbomify.com/CVE-2023-52121/): WordPress NitroPack Plugin <= 1.10.2 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-52120](https://insights.sbomify.com/CVE-2023-52120/): WordPress NEX-Forms – Ultimate Form Builder Plugin <= 8.5.2 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-5212](https://insights.sbomify.com/CVE-2023-5212/): Path traversal in WPBot – AI ChatBot for Live Support, Lead Generation, AI Services (critical 9.6)
- [CVE-2023-52119](https://insights.sbomify.com/CVE-2023-52119/): WordPress Icegram Plugin <= 3.1.18 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-52118](https://insights.sbomify.com/CVE-2023-52118/): WordPress WP User Profile Avatar Plugin <= 1.0 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-52117](https://insights.sbomify.com/CVE-2023-52117/): WordPress ProfileGrid plugin <= 5.6.6 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2023-52116](https://insights.sbomify.com/CVE-2023-52116/): Missing authorization in EMUI (high 7.5)
- [CVE-2023-52115](https://insights.sbomify.com/CVE-2023-52115/): Use after free in HarmonyOS (high 7.5)
- [CVE-2023-52114](https://insights.sbomify.com/CVE-2023-52114/): Information disclosure in EMUI (high 7.5)
- [CVE-2023-52113](https://insights.sbomify.com/CVE-2023-52113/): Denial of service in EMUI (high 7.5)
- [CVE-2023-52112](https://insights.sbomify.com/CVE-2023-52112/): Missing authorization in EMUI (medium 5.3)
- [CVE-2023-52111](https://insights.sbomify.com/CVE-2023-52111/): Auth bypass in EMUI (high 7.5)
- [CVE-2023-52110](https://insights.sbomify.com/CVE-2023-52110/): Memory corruption in HarmonyOS (high 7.5)
- [CVE-2023-5211](https://insights.sbomify.com/CVE-2023-5211/): Fattura24 < 6.2.8 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2023-52109](https://insights.sbomify.com/CVE-2023-52109/): Security feature bypass in EMUI (high 7.5)
- [CVE-2023-52108](https://insights.sbomify.com/CVE-2023-52108/): Denial of service in EMUI (high 7.5)
- [CVE-2023-52107](https://insights.sbomify.com/CVE-2023-52107/): Missing authorization in EMUI (high 7.5)
- [CVE-2023-52106](https://insights.sbomify.com/CVE-2023-52106/): Missing authorization in EMUI (medium 4.4)
- [CVE-2023-52105](https://insights.sbomify.com/CVE-2023-52105/): Privilege escalation in HarmonyOS (high 7.5)
- [CVE-2023-52104](https://insights.sbomify.com/CVE-2023-52104/): Other in EMUI (high 7.5)
- [CVE-2023-52103](https://insights.sbomify.com/CVE-2023-52103/): Memory corruption in EMUI (critical 9.8)
- [CVE-2023-52102](https://insights.sbomify.com/CVE-2023-52102/): Other in EMUI (high 7.5)
- [CVE-2023-52101](https://insights.sbomify.com/CVE-2023-52101/): Information disclosure in EMUI (critical 9.1)
- [CVE-2023-52100](https://insights.sbomify.com/CVE-2023-52100/): Missing authorization in HarmonyOS (high 7.5)
- [CVE-2023-5210](https://insights.sbomify.com/CVE-2023-5210/): AMP+ Plus <= 3.0 - Reflected Cross Site Scripting (medium 6.1)
- [CVE-2023-52099](https://insights.sbomify.com/CVE-2023-52099/): Security feature bypass in EMUI (high 7.5)
- [CVE-2023-52098](https://insights.sbomify.com/CVE-2023-52098/): Denial of service in EMUI (high 7.5)
- [CVE-2023-52097](https://insights.sbomify.com/CVE-2023-52097/): Security feature bypass in EMUI (high 7.5)
- [CVE-2023-52096](https://insights.sbomify.com/CVE-2023-52096/): Other in steve-community:ocpp-jaxb (high 7.5)
- [CVE-2023-52094](https://insights.sbomify.com/CVE-2023-52094/): Privilege escalation in Trend Micro Apex One (high 7.8)
- [CVE-2023-52093](https://insights.sbomify.com/CVE-2023-52093/): Privilege escalation in Trend Micro Apex One (high 7.4)
- [CVE-2023-52092](https://insights.sbomify.com/CVE-2023-52092/): Privilege escalation in Trend Micro Apex One (high 7.8)
- [CVE-2023-52091](https://insights.sbomify.com/CVE-2023-52091/): Privilege escalation in Trend Micro Apex One (high 7.8)
- [CVE-2023-52090](https://insights.sbomify.com/CVE-2023-52090/): Privilege escalation in Trend Micro Apex One (high 7.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/163/