# Vulnerabilities published in 2023


- [CVE-2023-22720](https://insights.sbomify.com/CVE-2023-22720/): WordPress WP Links Page Plugin <= 4.9.3 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-2272](https://insights.sbomify.com/CVE-2023-2272/): Tiempo.com <= 0.1.2 - Reflected XSS (medium 6.1)
- [CVE-2023-22719](https://insights.sbomify.com/CVE-2023-22719/): WordPress GiveWP Plugin <= 2.25.1 is vulnerable to CSV Injection (medium 4.7)
- [CVE-2023-22718](https://insights.sbomify.com/CVE-2023-22718/): WordPress User Meta Manager Plugin <= 3.4.9 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-22717](https://insights.sbomify.com/CVE-2023-22717/): WordPress FormCraft Plugin <= 1.2.6 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-22716](https://insights.sbomify.com/CVE-2023-22716/): WordPress OOPSpam Anti-Spam Plugin <= 1.1.35 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-22715](https://insights.sbomify.com/CVE-2023-22715/): WordPress WP-CommentNavi Plugin <= 1.12.1 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-22714](https://insights.sbomify.com/CVE-2023-22714/): WordPress Coming Soon by Supsystic Plugin <= 1.7.10 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-22713](https://insights.sbomify.com/CVE-2023-22713/): WordPress Gutenberg Blocks by WordPress Download Manager Plugin <= 2.1.8 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-22712](https://insights.sbomify.com/CVE-2023-22712/): WordPress TemplatesNext ToolKit Plugin <= 3.2.7 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-22711](https://insights.sbomify.com/CVE-2023-22711/): WordPress IMPress Listings Plugin <= 2.6.2 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-22710](https://insights.sbomify.com/CVE-2023-22710/): Cross-site scripting in Return and Warranty Management System for WooCommerce (high 7.1)
- [CVE-2023-2271](https://insights.sbomify.com/CVE-2023-2271/): Tiempo.com <= 0.1.2 - Shortcode Deletion via CSRF (medium 4.3)
- [CVE-2023-22709](https://insights.sbomify.com/CVE-2023-22709/): WordPress SRS Simple Hits Counter Plugin <= 1.1.0 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-22708](https://insights.sbomify.com/CVE-2023-22708/): WordPress Kraken.io Image Optimizer plugin <= 2.6.7 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2023-22707](https://insights.sbomify.com/CVE-2023-22707/): WordPress Greenshift – animation and page builder blocks Plugin <= 4.9.9 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-22706](https://insights.sbomify.com/CVE-2023-22706/): WordPress PropertyHive Plugin <= 1.5.48 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-22705](https://insights.sbomify.com/CVE-2023-22705/): WordPress Welcart e-Commerce Plugin <= 2.8.10 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-22704](https://insights.sbomify.com/CVE-2023-22704/): WordPress teachPress Plugin <= 8.1.8 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-22703](https://insights.sbomify.com/CVE-2023-22703/): WordPress WCP Contact Form Plugin <= 3.1.0 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-22702](https://insights.sbomify.com/CVE-2023-22702/): WordPress WPMobile.App — Android and iOS Mobile Application Plugin <= 11.13 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-22701](https://insights.sbomify.com/CVE-2023-22701/): WordPress Ebook Store plugin <= 5.775 - Broken Authentication vulnerability (high 7.5)
- [CVE-2023-22700](https://insights.sbomify.com/CVE-2023-22700/): Cross-site request forgery in PixelYourSite – Your smart PIXEL (TAG) Manager (medium 4.3)
- [CVE-2023-2270](https://insights.sbomify.com/CVE-2023-2270/): Local privilege escalation (high 7.0)
- [CVE-2023-22699](https://insights.sbomify.com/CVE-2023-22699/): WordPress MainWP Wordfence Extension Plugin <= 4.0.7 - Subscriber+ Arbitrary Plugin Activation Vulnerability (medium 5.4)
- [CVE-2023-22698](https://insights.sbomify.com/CVE-2023-22698/): WordPress Theme Blvd Responsive Google Maps Plugin <= 1.0.2 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-22697](https://insights.sbomify.com/CVE-2023-22697/): WordPress Survey Maker plugin <= 3.2.0 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2023-22696](https://insights.sbomify.com/CVE-2023-22696/): WordPress Affiliate Links Lite Plugin <= 2.5 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-22695](https://insights.sbomify.com/CVE-2023-22695/): WordPress Custom Field Template Plugin <= 2.5.8 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-22694](https://insights.sbomify.com/CVE-2023-22694/): WordPress BigContact Plugin <= 1.5.8 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-22693](https://insights.sbomify.com/CVE-2023-22693/): WordPress WP Google Tag Manager Plugin <= 1.1 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-22692](https://insights.sbomify.com/CVE-2023-22692/): WordPress Name Directory Plugin <= 1.27.1 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-22691](https://insights.sbomify.com/CVE-2023-22691/): WordPress Category Specific RSS feed Subscription Plugin <= v2.1 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-22690](https://insights.sbomify.com/CVE-2023-22690/): WordPress Ebook Store Plugin <= 5.775 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-2269](https://insights.sbomify.com/CVE-2023-2269/): Denial of service in Kernel (medium 4.4)
- [CVE-2023-22689](https://insights.sbomify.com/CVE-2023-22689/): WordPress Auto Affiliate Links Plugin <= 6.3 is vulnerable to Broken Access Control (medium 5.4)
- [CVE-2023-22688](https://insights.sbomify.com/CVE-2023-22688/): WordPress WP Tabs Slides Plugin <= 2.0.3 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-22687](https://insights.sbomify.com/CVE-2023-22687/): Information disclosure in Freesoul Deactivate Plugins – Plugin manager and cleanup (low 3.7)
- [CVE-2023-22686](https://insights.sbomify.com/CVE-2023-22686/): WordPress Nice PayPal Button Lite Plugin <= 1.3.5 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-22685](https://insights.sbomify.com/CVE-2023-22685/): WordPress Category Specific RSS feed Subscription Plugin <= v2.2 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-22684](https://insights.sbomify.com/CVE-2023-22684/): WordPress Subscribers – Free Web Push Notifications Plugin <= 1.5.3 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-22683](https://insights.sbomify.com/CVE-2023-22683/): WordPress Clio Grow Plugin <= 1.0.0 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-22682](https://insights.sbomify.com/CVE-2023-22682/): WordPress Camera slideshow Plugin <= 1.4.0.1 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-22681](https://insights.sbomify.com/CVE-2023-22681/): WordPress Online Exam Software : eExamhall Plugin <= 4.0 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-22680](https://insights.sbomify.com/CVE-2023-22680/): WordPress No API Amazon Affiliate Plugin <= 4.2.2 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-2268](https://insights.sbomify.com/CVE-2023-2268/): Plane v0.7.1 - Unauthorized access to files (high 7.1)
- [CVE-2023-22679](https://insights.sbomify.com/CVE-2023-22679/): WordPress WP Better Emails Plugin <= 0.4 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-22678](https://insights.sbomify.com/CVE-2023-22678/): WordPress Superior FAQ Plugin <= 1.0.2 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-22677](https://insights.sbomify.com/CVE-2023-22677/): WordPress WP Booklet Plugin <= 2.1.8 is vulnerable to Remote Code Execution (RCE) (high 8.5)
- [CVE-2023-22676](https://insights.sbomify.com/CVE-2023-22676/): WordPress Advanced Custom Fields: Image Crop Add-on Plugin <= 1.4.12 is vulnerable to Broken Access Control (low 3.1)
- [CVE-2023-22675](https://insights.sbomify.com/CVE-2023-22675/): WordPress WP Fast Cache plugin <= 1.5 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2023-22674](https://insights.sbomify.com/CVE-2023-22674/): WordPress Dashicons + Custom Post Types Plugin <= 1.0.2 is vulnerable to Broken Access Control (medium 5.4)
- [CVE-2023-22673](https://insights.sbomify.com/CVE-2023-22673/): WordPress Website Monetization by MageNet Plugin <= 1.0.29.1 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-22672](https://insights.sbomify.com/CVE-2023-22672/): WordPress vSlider Multi Image Slider for WordPress Plugin <= 4.1.2 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-22671](https://insights.sbomify.com/CVE-2023-22671/): Command injection in nsa:ghidra (critical 9.8)
- [CVE-2023-22670](https://insights.sbomify.com/CVE-2023-22670/): Memory corruption in opendesign:drawings sdk (high 7.8)
- [CVE-2023-2267](https://insights.sbomify.com/CVE-2023-2267/): Improper input validation could lead to reflection injection attacks (medium 4.3)
- [CVE-2023-22669](https://insights.sbomify.com/CVE-2023-22669/): Memory corruption in opendesign:drawings sdk (high 7.8)
- [CVE-2023-22668](https://insights.sbomify.com/CVE-2023-22668/): Use After Free in Audio (medium 6.7)
- [CVE-2023-22667](https://insights.sbomify.com/CVE-2023-22667/): Integer Overflow or Wraparound in Audio (high 8.4)
- [CVE-2023-22666](https://insights.sbomify.com/CVE-2023-22666/): Integer Overflow or Wraparound in Audio (high 8.4)
- [CVE-2023-22665](https://insights.sbomify.com/CVE-2023-22665/): Apache Jena: Exposure of arbitrary execution in script engine expressions. (medium 5.4)
- [CVE-2023-22664](https://insights.sbomify.com/CVE-2023-22664/): BIG-IP HTTP/2 profile vulnerability (high 7.5)
- [CVE-2023-22663](https://insights.sbomify.com/CVE-2023-22663/): Auth bypass in Intel Unison software (medium 5.9)
- [CVE-2023-22662](https://insights.sbomify.com/CVE-2023-22662/): Denial of service in UEFI firmware for some Intel(R) Server Board S2600BP products (medium 5.8)
- [CVE-2023-22661](https://insights.sbomify.com/CVE-2023-22661/): Memory corruption in Intel(R) Server Board BMC firmware (high 8.2)
- [CVE-2023-22660](https://insights.sbomify.com/CVE-2023-22660/): Memory corruption in Ichitaro (high 7.0)
- [CVE-2023-2266](https://insights.sbomify.com/CVE-2023-2266/): Improper neutralization of input during web page generation could lead to cross-site scripting based attacks (medium 4.3)
- [CVE-2023-22659](https://insights.sbomify.com/CVE-2023-22659/): Command injection in UR32L (high 7.2)
- [CVE-2023-22657](https://insights.sbomify.com/CVE-2023-22657/): F5OS vulnerability (high 7.0)
- [CVE-2023-22656](https://insights.sbomify.com/CVE-2023-22656/): Memory corruption in Intel(R) Media SDK and some Intel(R) oneVPL software (low 3.9)
- [CVE-2023-22655](https://insights.sbomify.com/CVE-2023-22655/): Security feature bypass in 3rd and 4th Generation Intel(R) Xeon(R) Processors when using Intel(R) SGX or Intel(R) TDX (medium 6.1)
- [CVE-2023-22654](https://insights.sbomify.com/CVE-2023-22654/): Cross-site scripting in T&D Corporation and ESPEC MIC CORP. data logger products (medium 5.4)
- [CVE-2023-22653](https://insights.sbomify.com/CVE-2023-22653/): Command injection in UR32L (high 8.8)
- [CVE-2023-22652](https://insights.sbomify.com/CVE-2023-22652/): Stack buffer overflow in "read_file" function (low 3.3)
- [CVE-2023-22651](https://insights.sbomify.com/CVE-2023-22651/): Rancher Webhook is misconfigured during upgrade process (critical 9.9)
- [CVE-2023-22650](https://insights.sbomify.com/CVE-2023-22650/): Rancher does not automatically clean up a user deleted or disabled from the configured Authentication Provider (high 8.7)
- [CVE-2023-2265](https://insights.sbomify.com/CVE-2023-2265/): Improper restriction of rendered UI layers or frames could lead to clickjacking attack (medium 4.3)
- [CVE-2023-22649](https://insights.sbomify.com/CVE-2023-22649/): Rancher 'Audit Log' leaks sensitive information (high 8.4)
- [CVE-2023-22648](https://insights.sbomify.com/CVE-2023-22648/): Rancher's Azure AD permission changes are not reflected on active sessions (high 8.0)
- [CVE-2023-22647](https://insights.sbomify.com/CVE-2023-22647/): Rancher vulnerable to Privilege Escalation via manipulation of Secrets (critical 9.9)
- [CVE-2023-22645](https://insights.sbomify.com/CVE-2023-22645/): kubewarden: Excessive permissions for kubewarden-controller-manager-cluster-role (high 8.0)
- [CVE-2023-22644](https://insights.sbomify.com/CVE-2023-22644/): JWT token compromise can allow malicious actions including Remote Code Execution (RCE) (critical 9.4)
- [CVE-2023-22643](https://insights.sbomify.com/CVE-2023-22643/): libzypp-plugin-appdata: potential arbitrary code execution via shell injection due to `os.system` calls (medium 6.3)
- [CVE-2023-22642](https://insights.sbomify.com/CVE-2023-22642/): Security feature bypass in FortiAnalyzer (medium 6.8)
- [CVE-2023-22641](https://insights.sbomify.com/CVE-2023-22641/): Open redirect in FortiOS (medium 4.1)
- [CVE-2023-22640](https://insights.sbomify.com/CVE-2023-22640/): Memory corruption in FortiOS (high 7.1)
- [CVE-2023-2264](https://insights.sbomify.com/CVE-2023-2264/): Improper input validition could lead to code injection (medium 4.0)
- [CVE-2023-22639](https://insights.sbomify.com/CVE-2023-22639/): Memory corruption in FortiOS (medium 6.3)
- [CVE-2023-22638](https://insights.sbomify.com/CVE-2023-22638/): Cross-site scripting in FortiNAC (medium 6.7)
- [CVE-2023-22637](https://insights.sbomify.com/CVE-2023-22637/): Cross-site scripting in FortiNAC (medium 5.9)
- [CVE-2023-22636](https://insights.sbomify.com/CVE-2023-22636/): Missing authorization in FortiWeb (medium 6.6)
- [CVE-2023-22635](https://insights.sbomify.com/CVE-2023-22635/): Privilege escalation in FortiClientMac (medium 6.9)
- [CVE-2023-22633](https://insights.sbomify.com/CVE-2023-22633/): Denial of service in FortiNAC (high 7.2)
- [CVE-2023-22632](https://insights.sbomify.com/CVE-2023-22632/): Other in PRTG Network Monitor (low 2.7)
- [CVE-2023-22631](https://insights.sbomify.com/CVE-2023-22631/): Other in PRTG Network Monitor (low 2.7)
- [CVE-2023-22630](https://insights.sbomify.com/CVE-2023-22630/): SQL injection in izybat:orange casiers (medium 4.3)
- [CVE-2023-2263](https://insights.sbomify.com/CVE-2023-2263/): Rockwell Automation Kinetix 5700 DC Bus Power Supply Series A – CIP Message Attack Could Cause Denial-Of-Service (high 7.5)
- [CVE-2023-22629](https://insights.sbomify.com/CVE-2023-22629/): Path traversal in southrivertech:titan ftp server (high 8.8)
- [CVE-2023-22626](https://insights.sbomify.com/CVE-2023-22626/): PgHero Allows Information Disclosure Through EXPLAIN Feature (high 7.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/387/