Export limit exceeded: 425868 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 5

Export CSV
CVE-2023-46623

WordPress WP EXtra Plugin <= 6.2 is vulnerable to Remote Code Execution (RCE)

Improper Control of Generation of Code ('Code Injection') vulnerability in TienCOP WP EXtra.This issue affects WP EXtra: from n/a through 6.2.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed
Vendors
Wpvnteam
Products
Wp Extra
CVE-2023-46212

WordPress WP EXtra Plugin <= 6.2 is vulnerable to Broken Access Control

Missing Authorization, Cross-Site Request Forgery (CSRF) vulnerability in TienCOP WP EXtra allows Accessing Functionality Not Properly Constrained by ACLs, Cross Site Request Forgery.This issue affects WP EXtra: from n/a through 6.2.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wpvnteam
Products
Wp Extra
CVE-2023-5314

WP EXtra <= 6.2 - Missing Authorization to Arbitrary Email Sending

The WP EXtra plugin for WordPress is vulnerable to unauthorized access to restricted functionality due to a missing capability check on the 'test-email' section of the register() function in versions up to, and including, 6.2. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to send emails with arbitrary content to arbitrary locations from the affected site's mail server.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wpvnteam
Products
Wp Extra
CVE-2023-5311

WP EXtra <= 6.2 - Missing Authorization to .htaccess File Modification

The WP EXtra plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the register() function in versions up to, and including, 6.2. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to modify the contents of the .htaccess files located in a site's root directory or /wp-content and /wp-includes folders and achieve remote code execution. CVE-2023-46623 appears to be a duplicate of this issue.

CVSS 3.1 · 8.8 High EPSS 1.9% KEV · Not listed
Vendors
Wpvnteam
Products
Wp Extra
CVE-2023-47825

WordPress WP EXtra Plugin <= 6.4 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery (CSRF) vulnerability in TienCOP WP EXtra plugin <= 6.4 versions.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wpvnteam
Products
Wp Extra