9.6Kritisch

CVE-2023-51545WordPress Job Manager & Career Plugin <= 1.4.4 is vulnerable to Cross Site Request Forgery (CSRF) leading to PHP Object Injection

ThemeHigh Job Manager & Career – Manage job board listings, and recruitments Veröffentlicht: 2023-12-29 15:48 (vor 2 Jahren)

Beschreibung

Cross-Site Request Forgery (CSRF), Deserialization of Untrusted Data vulnerability in ThemeHigh Job Manager & Career – Manage job board listings, and recruitments.This issue affects Job Manager & Career – Manage job board listings, and recruitments: from n/a through 1.4.4.

Schwachstellentyp (CWE): CWE-352 CWE-502

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

Hersteller	Produkt	Versionen
ThemeHigh	Job Manager & Career – Manage job board listings, and recruitments	≤ 1.4.4

Referenzen und Patches

https://patchstack.com/database/vulnerability/job-manager-career/wordpress-job-manager-career-plugin-1-4-4-cr… vdb-entry

CVSS-Score

9.6Kritisch

Quelle: Patchstack · CVSS 3.1

Angriffsvektor: Netzwerk
Komplexität: Niedrig
Rechte erforderlich: Keine
Benutzerinteraktion: Erforderlich
Geltungsbereich: Geändert
Vertraulichkeit: Hoch
Integrität: Hoch
Verfügbarkeit: Hoch

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

EPSS (Ausnutzungswahrscheinlichkeit in 30 Tagen)

0.27%

höher als 19 % aller CVEs

Zeitverlauf

ID reserviert2023-12-20
Veröffentlicht2023-12-29 15:48
Bei IP-DB eingegangen2026-10-24 23:52
Zuletzt aktualisiert2026-04-28 19:09

Vergeben von (CNA): Patchstack

In der Quelle ansehen: CVE.org · NVD

Benachrichtigung bei neuen Schwachstellen in diesen Produkten

E-Mail-Warnungen aktivieren

Kostenlos · mit Konto · jederzeit abbestellbar

Neue CVEs im selben Produkt — WordPress plugins & themes

7.1Hoch

CVE-2026-115431 vor 2 Stunden

WordPress Upsell Order Bump Offer for WooCommerce plugin <= 3.1.6 - Broken Access Control vulnerability

WP Swings Upsell Order Bump Offer for WooCommerce

Missing Authorization vulnerability in WP Swings Upsell Order Bump Offer for WooCommerce upsell-order-bump-offer-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Upsell Order Bump Offer for WooCommerce…

6.5Mittel

CVE-2026-115952 vor 2 Stunden

WordPress Forminator plugin <= 1.58.3 - Cross Site Scripting (XSS) vulnerability

WPMU DEV Forminator

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPMU DEV Forminator forminator allows Stored XSS.This issue affects Forminator: from n/a through 1.58.3.

7.1Hoch

CVE-2026-109883 vor 2 Stunden

WordPress Elementor Website Builder plugin <= 4.3.5 - Cross Site Scripting (XSS) vulnerability

Elementor Elementor Website Builder

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Elementor Elementor Website Builder elementor allows Code Injection.This issue affects Elementor Website Builder: from n/a through 4.3.5.

7.1Hoch

CVE-2026-109884 vor 2 Stunden

WordPress Elementor Website Builder plugin <= 4.3.5 - Cross Site Scripting (XSS) vulnerability

Elementor Elementor Website Builder

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Elementor Elementor Website Builder elementor allows Reflected XSS.This issue affects Elementor Website Builder: from n/a through 4.3.5.

5.4Mittel

CVE-2026-103908 vor 3 Stunden

AMP for WP <= 1.1.18 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Author Biographical Info

mohammed_kaludi AMP for WP – Accelerated Mobile Pages

The The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.1.18. This is due to the software allowing users to execute an action that does not properly validate a v…

5.4Mittel

CVE-2026-107658 vor 3 Stunden

BuddyForms <= 2.10.5 - Unauthenticated Stored Cross-Site Scripting via 'bf_post_type' Parameter via Post-Type Confusion

themekraft BuddyForms

The BuddyForms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'bf_post_type (and buddyforms_form_content)' parameter in all versions up to, and including, 2.10.5 due to insufficient input sanitization and output escaping. This makes…