# Vulnerabilities published in 2023


- [CVE-2023-47808](https://insights.sbomify.com/CVE-2023-47808/): WordPress Add Widgets to Page Plugin <= 1.3.2 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-47807](https://insights.sbomify.com/CVE-2023-47807/): WordPress 10WebAnalytics plugin <= 1.2.12 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2023-47806](https://insights.sbomify.com/CVE-2023-47806/): WordPress Disable User Login Plugin <= 1.3.7 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-47805](https://insights.sbomify.com/CVE-2023-47805/): WordPress WPCafe plugin <= 2.2.22 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2023-47804](https://insights.sbomify.com/CVE-2023-47804/): Apache OpenOffice: Macro URL arbitrary script execution (high 8.8)
- [CVE-2023-47803](https://insights.sbomify.com/CVE-2023-47803/): Path traversal in Camera Firmware (medium 5.3)
- [CVE-2023-47802](https://insights.sbomify.com/CVE-2023-47802/): Command injection in Camera Firmware (high 7.2)
- [CVE-2023-47801](https://insights.sbomify.com/CVE-2023-47801/): Missing authorization in clickstudios:passwordstate (medium 4.7)
- [CVE-2023-47800](https://insights.sbomify.com/CVE-2023-47800/): Hardcoded credentials in natus:neuroworks eeg (critical 9.8)
- [CVE-2023-47799](https://insights.sbomify.com/CVE-2023-47799/): Information disclosure in mahara:mahara (high 7.5)
- [CVE-2023-47798](https://insights.sbomify.com/CVE-2023-47798/): Liferay Portal's account lockout does not invalidate existing user sessions (medium 5.4)
- [CVE-2023-47797](https://insights.sbomify.com/CVE-2023-47797/): Liferay Portal XSS with `p_l_back_url_title` on edit content page (critical 9.6)
- [CVE-2023-47795](https://insights.sbomify.com/CVE-2023-47795/): Liferay Portal Document and Media widget and Liferay DXP vulnerable to stored Cross-site Scripting (critical 9.0)
- [CVE-2023-47793](https://insights.sbomify.com/CVE-2023-47793/): WordPress Acme Fix Images plugin <= 1.0.0 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2023-47792](https://insights.sbomify.com/CVE-2023-47792/): WordPress Big File Uploads Plugin <= 2.1.1 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-47791](https://insights.sbomify.com/CVE-2023-47791/): WordPress Leadster Plugin <= 1.1.2 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-47790](https://insights.sbomify.com/CVE-2023-47790/): WordPress Pz-LinkCard Plugin <= 2.4.8 is vulnerable to Cross Site Request Forgery (CSRF) (high 7.1)
- [CVE-2023-4779](https://insights.sbomify.com/CVE-2023-4779/): Cross-site scripting in User Submitted Posts – Enable Users to Submit Posts from the Front End (medium 6.4)
- [CVE-2023-47789](https://insights.sbomify.com/CVE-2023-47789/): WordPress WooCommerce Canada Post Shipping Plugin <= 2.8.3 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-47788](https://insights.sbomify.com/CVE-2023-47788/): WordPress Jetpack plugin < 12.7 - Contributor+ Broken Access Control vulnerability (medium 4.3)
- [CVE-2023-47787](https://insights.sbomify.com/CVE-2023-47787/): WordPress WooCommerce Bookings Plugin <= 2.0.3 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-47786](https://insights.sbomify.com/CVE-2023-47786/): WordPress LayerSlider Plugin <= 7.7.9 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-47785](https://insights.sbomify.com/CVE-2023-47785/): WordPress LayerSlider Plugin <= 7.7.9 is vulnerable to Cross Site Request Forgery (CSRF) (high 7.1)
- [CVE-2023-47784](https://insights.sbomify.com/CVE-2023-47784/): WordPress Slider Revolution Plugin <= 6.6.15 is vulnerable to Arbitrary File Upload (high 8.4)
- [CVE-2023-47783](https://insights.sbomify.com/CVE-2023-47783/): WordPress Thrive Theme Builder theme < 3.24.0 - Multiple Authenticated Broken Access Control vulnerability (high 8.3)
- [CVE-2023-47782](https://insights.sbomify.com/CVE-2023-47782/): WordPress Thrive Theme Builder theme < 3.24.0 - Authenticated Privilege Escalation vulnerability (high 8.8)
- [CVE-2023-47781](https://insights.sbomify.com/CVE-2023-47781/): WordPress Thrive Theme Builder Theme < 3.24.2 is vulnerable to Cross Site Request Forgery (CSRF) (high 8.8)
- [CVE-2023-47780](https://insights.sbomify.com/CVE-2023-47780/): WordPress EasyAzon – Amazon Associates Affiliate Plugin plugin <= 5.1.0 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2023-4778](https://insights.sbomify.com/CVE-2023-4778/): Out-of-bounds Read in gpac/gpac (medium 5.9)
- [CVE-2023-47779](https://insights.sbomify.com/CVE-2023-47779/): WordPress Integration for Contact Form 7 and Constant Contact Plugin <= 1.1.4 is vulnerable to Open Redirection (medium 4.7)
- [CVE-2023-47778](https://insights.sbomify.com/CVE-2023-47778/): WordPress LuckyWP Scripts Control plugin <= 1.2.1 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2023-47777](https://insights.sbomify.com/CVE-2023-47777/): WordPress WooCommerce and WooCommerce Blocks plugins - Auth. Cross-Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2023-47776](https://insights.sbomify.com/CVE-2023-47776/): WordPress miniorange otp verification plugin <= 4.2.1 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2023-47775](https://insights.sbomify.com/CVE-2023-47775/): WordPress wpDiscuz Plugin <= 7.6.11 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-47774](https://insights.sbomify.com/CVE-2023-47774/): WordPress Jetpack plugin < 12.7 - Auth. Iframe Injection vulnerability (medium 5.4)
- [CVE-2023-47773](https://insights.sbomify.com/CVE-2023-47773/): WordPress Permalinks Customizer Plugin <= 2.8.2 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-47772](https://insights.sbomify.com/CVE-2023-47772/): WordPress Slider Revolution Plugin <= 6.6.14 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-47771](https://insights.sbomify.com/CVE-2023-47771/): WordPress Essential Grid plugin <= 3.0.18 - Multiple Authenticated Broken Access Control vulnerability (high 8.3)
- [CVE-2023-47770](https://insights.sbomify.com/CVE-2023-47770/): WordPress BeTheme theme <= 27.1.1 - Contributor+ Broken Access Control vulnerability (high 7.6)
- [CVE-2023-4777](https://insights.sbomify.com/CVE-2023-4777/): Incorrect Permission Assignment on Qualys Container Scanning Connector Plugin 1.6.2.6 and earlier (low 3.1)
- [CVE-2023-47769](https://insights.sbomify.com/CVE-2023-47769/): WordPress WP Maintenance plugin <= 6.1.3 - IP Filtering Bypass vulnerability (low 3.7)
- [CVE-2023-47768](https://insights.sbomify.com/CVE-2023-47768/): WordPress Footer Putter Plugin <= 1.17 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-47767](https://insights.sbomify.com/CVE-2023-47767/): WordPress Interactive World Map Plugin <= 3.2.0 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-47766](https://insights.sbomify.com/CVE-2023-47766/): WordPress Post Status Notifier Lite Plugin <= 1.11.0 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-47765](https://insights.sbomify.com/CVE-2023-47765/): Cross-site request forgery in CodeBard's Patron Button and Widgets for Patreon (medium 4.3)
- [CVE-2023-47764](https://insights.sbomify.com/CVE-2023-47764/): WordPress Ditty plugin <= 3.1.24 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2023-47763](https://insights.sbomify.com/CVE-2023-47763/): WordPress WP Custom Admin Interface plugin <= 7.31 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2023-47762](https://insights.sbomify.com/CVE-2023-47762/): WordPress BetterDocs plugin <= 2.5.2 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2023-47761](https://insights.sbomify.com/CVE-2023-47761/): WordPress Simple 301 Redirects by BetterLinks plugin <= 2.0.7 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2023-47760](https://insights.sbomify.com/CVE-2023-47760/): WordPress Essential Blocks plugin <= 4.2.0 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2023-4776](https://insights.sbomify.com/CVE-2023-4776/): WPSchoolPress < 2.2.5 - Teacher+ SQLi (high 8.8)
- [CVE-2023-47759](https://insights.sbomify.com/CVE-2023-47759/): WordPress Chaty plugin <= 3.1.2 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2023-47758](https://insights.sbomify.com/CVE-2023-47758/): WordPress Multi Step Form Plugin <= 1.7.11 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-47757](https://insights.sbomify.com/CVE-2023-47757/): WordPress AWeber Plugin <= 7.3.9 is vulnerable to Broken Access Control (medium 4.3)
- [CVE-2023-47756](https://insights.sbomify.com/CVE-2023-47756/): WordPress Welcome Email Editor plugin <= 5.0.6 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2023-47755](https://insights.sbomify.com/CVE-2023-47755/): WordPress WooCommerce Product Carousel Slider Plugin <= 3.3.5 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-47754](https://insights.sbomify.com/CVE-2023-47754/): WordPress Delete Duplicate Posts Plugin <= 4.8.9 is vulnerable to Broken Access Control (medium 4.3)
- [CVE-2023-4775](https://insights.sbomify.com/CVE-2023-4775/): Advanced iFrame <= 2023.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2023-47747](https://insights.sbomify.com/CVE-2023-47747/): IBM Db2 denial of service (medium 5.3)
- [CVE-2023-47746](https://insights.sbomify.com/CVE-2023-47746/): IBM Db2 denial of service (medium 5.3)
- [CVE-2023-47745](https://insights.sbomify.com/CVE-2023-47745/): IBM MQ Container information disclosure (medium 6.2)
- [CVE-2023-47742](https://insights.sbomify.com/CVE-2023-47742/): IBM QRadar Suite information dislosure (medium 5.9)
- [CVE-2023-47741](https://insights.sbomify.com/CVE-2023-47741/): IBM i information disclosure (medium 5.3)
- [CVE-2023-4774](https://insights.sbomify.com/CVE-2023-4774/): WP-Matomo Integration (WP-Piwik) <= 1.0.28 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2023-47731](https://insights.sbomify.com/CVE-2023-47731/): IBM QRadar Suite Software cross-site scripting (medium 5.4)
- [CVE-2023-4773](https://insights.sbomify.com/CVE-2023-4773/): WordPress Social Login <= 3.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2023-47728](https://insights.sbomify.com/CVE-2023-47728/): IBM QRadar Suite Software information disclosure (medium 6.5)
- [CVE-2023-47727](https://insights.sbomify.com/CVE-2023-47727/): IBM QRadar Suite Software file manipulation (medium 4.3)
- [CVE-2023-47726](https://insights.sbomify.com/CVE-2023-47726/): IBM QRadar Suite improper input validation (high 7.1)
- [CVE-2023-47722](https://insights.sbomify.com/CVE-2023-47722/): IBM API Connect information disclosure (medium 6.2)
- [CVE-2023-4772](https://insights.sbomify.com/CVE-2023-4772/): Newsletter <= 7.8.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2023-47718](https://insights.sbomify.com/CVE-2023-47718/): IBM Maximo Asset Management cross-site request forgery (medium 4.3)
- [CVE-2023-47717](https://insights.sbomify.com/CVE-2023-47717/): IBM Security Guardium denial of service (medium 4.4)
- [CVE-2023-47716](https://insights.sbomify.com/CVE-2023-47716/): IBM FileNet Content Manager privilege escalation (medium 6.3)
- [CVE-2023-47715](https://insights.sbomify.com/CVE-2023-47715/): IBM Storage Protect Plus Server improper access control (medium 4.3)
- [CVE-2023-47714](https://insights.sbomify.com/CVE-2023-47714/): IBM Sterling File Gateway cross-site scripting (medium 4.8)
- [CVE-2023-47712](https://insights.sbomify.com/CVE-2023-47712/): IBM Security Guardium privilege escalation (high 7.8)
- [CVE-2023-47711](https://insights.sbomify.com/CVE-2023-47711/): IBM Security Guardium denial of service (low 2.7)
- [CVE-2023-47710](https://insights.sbomify.com/CVE-2023-47710/): IBM Security Guardium cross-site scripting (medium 5.4)
- [CVE-2023-4771](https://insights.sbomify.com/CVE-2023-4771/): Cross-Site Scripting vulnerability in CKSource CKEditor (medium 6.1)
- [CVE-2023-47709](https://insights.sbomify.com/CVE-2023-47709/): IBM Security Guardium command injection (critical 9.1)
- [CVE-2023-47707](https://insights.sbomify.com/CVE-2023-47707/): IBM Security Guardium Key Lifecycle Manager cross-site scripting (medium 5.4)
- [CVE-2023-47706](https://insights.sbomify.com/CVE-2023-47706/): IBM Security Guardium Key Lifecycle Manager file upload (medium 6.6)
- [CVE-2023-47705](https://insights.sbomify.com/CVE-2023-47705/): IBM Security Guardium Key Lifecycle Manager improper input validation (medium 4.3)
- [CVE-2023-47704](https://insights.sbomify.com/CVE-2023-47704/): IBM Security Guardium Key Lifecycle Manager information disclosure (medium 4.0)
- [CVE-2023-47703](https://insights.sbomify.com/CVE-2023-47703/): IBM Security Guardium Key Lifecycle Manager information disclosure (medium 5.3)
- [CVE-2023-47702](https://insights.sbomify.com/CVE-2023-47702/): IBM Security Guardium Key Lifecycle Manager directory traversal (medium 4.3)
- [CVE-2023-47701](https://insights.sbomify.com/CVE-2023-47701/): IBM Db2 denial of service (medium 6.5)
- [CVE-2023-47700](https://insights.sbomify.com/CVE-2023-47700/): IBM Storage Virtualize improper certificate validation (medium 5.9)
- [CVE-2023-4770](https://insights.sbomify.com/CVE-2023-4770/): Uncontrolled Search Path Element Vulnerability in 4D and 4D Windows Server (medium 6.5)
- [CVE-2023-47699](https://insights.sbomify.com/CVE-2023-47699/): IBM Secure Proxy cross-site scripting (medium 6.1)
- [CVE-2023-47698](https://insights.sbomify.com/CVE-2023-47698/): WordPress Japanized For WooCommerce plugin <= 2.6.4 - Multiple Broken Access Control vulnerability (high 8.6)
- [CVE-2023-47697](https://insights.sbomify.com/CVE-2023-47697/): WordPress WP Event Manager Plugin <= 3.1.39 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-47696](https://insights.sbomify.com/CVE-2023-47696/): WordPress Product Enquiry for WooCommerce Plugin <= 3.0 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-47695](https://insights.sbomify.com/CVE-2023-47695/): WordPress Shortcodes Finder Plugin <= 1.5.3 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-47694](https://insights.sbomify.com/CVE-2023-47694/): WordPress Mini Cart Drawer For WooCommerce plugin <= 4.0.0 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2023-47693](https://insights.sbomify.com/CVE-2023-47693/): WordPress Ultimate Addons for Contact Form 7 plugin <= 3.2.6 - Broken Access Control vulnerability (high 7.5)
- [CVE-2023-47692](https://insights.sbomify.com/CVE-2023-47692/): WordPress Flo Forms plugin <= 1.0.41 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2023-47690](https://insights.sbomify.com/CVE-2023-47690/): WordPress Additional Order Filters for WooCommerce Plugin <= 1.10 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-4769](https://insights.sbomify.com/CVE-2023-4769/): Server-Side Request Forgery in ManageEngine Desktop Central (medium 6.6)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/194/