{"items":[{"id":"CVE-2023-47647","published":"2025-01-02T12:00:35.748Z","updated":"2026-04-28T16:08:50.086Z","title":"WordPress BadgeOS plugin <= 3.7.1.6 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"LearningTimes","product":"BadgeOS","kev":false,"epss":0.0046,"kevAdded":null},{"id":"CVE-2023-2173","published":"2023-08-31T05:33:14.047Z","updated":"2026-04-08T17:31:16.976Z","title":"BadgeOS <= 3.7.1.6 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Post Deletion","severity":"MEDIUM","score":6.5,"vendor":"learningtimes","product":"BadgeOS","kev":false,"epss":0.00515,"kevAdded":null},{"id":"CVE-2023-2171","published":"2023-08-31T05:33:11.293Z","updated":"2026-04-08T17:01:11.835Z","title":"BadgeOS <= 3.7.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"MEDIUM","score":5.4,"vendor":"learningtimes","product":"BadgeOS","kev":false,"epss":0.00357,"kevAdded":null},{"id":"CVE-2023-2174","published":"2023-08-31T05:33:08.533Z","updated":"2026-04-08T16:57:39.873Z","title":"BadgeOS <= 3.7.1.6 - Missing Authorization in delete_badgeos_log_entries","severity":"MEDIUM","score":4.3,"vendor":"learningtimes","product":"BadgeOS","kev":false,"epss":0.00386,"kevAdded":null},{"id":"CVE-2023-2172","published":"2023-08-31T05:33:08.078Z","updated":"2026-04-08T16:55:58.328Z","title":"BadgeOS <= 3.7.1.6 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Post Title Overwrite","severity":"MEDIUM","score":4.3,"vendor":"learningtimes","product":"BadgeOS","kev":false,"epss":0.00515,"kevAdded":null},{"id":"CVE-2022-41987","published":"2023-05-25T10:13:51.245Z","updated":"2026-04-28T16:07:50.110Z","title":"WordPress BadgeOS Plugin <= 3.7.1.6 is vulnerable to Cross Site Request Forgery (CSRF)","severity":"MEDIUM","score":6.3,"vendor":"LearningTimes","product":"BadgeOS","kev":false,"epss":0.00246,"kevAdded":null}]}