Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2025-06-20
CVE-2023-4757 - Before 1 Plugin
The Staff / Employee Business Directory for Active Directory WordPress plugin before 1.2.3 does not sanitize and escape data returned from the LDAP server before rendering it in the page, allowing users who can control their entries in the LDAP directory to inject malicious javascript which could be used against high-privilege users such as a site admin.
PLUGIN
Before 1
CVE-2023-4757
Risk Score
Threat Entry
Updated 2025-06-02
CVE-2023-6732 - Before 1 Plugin
The Ultimate Maps by Supsystic WordPress plugin before 1.2.16 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
PLUGIN
Before 1
CVE-2023-6732
Risk Score
Threat Entry
Updated 2025-06-20
CVE-2023-3372 - Before 1 Plugin
The Lana Shortcodes WordPress plugin before 1.2.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which allows users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
PLUGIN
Before 1
CVE-2023-3372
Risk Score
Threat Entry
Updated 2025-06-02
CVE-2023-0376 - Before 1 Plugin
The Qubely WordPress plugin before 1.8.5 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
PLUGIN
Before 1
CVE-2023-0376
Risk Score
Threat Entry
Updated 2025-06-11
CVE-2023-0389 - Before 1 Plugin
The Calculated Fields Form WordPress plugin before 1.1.151 does not sanitise and escape some of its form settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
PLUGIN
Before 1
CVE-2023-0389
Risk Score
Threat Entry
Updated 2025-06-11
CVE-2021-24566 - Before 1 Plugin
The WooCommerce Currency Switcher FOX WordPress plugin before 1.3.7 was vulnerable to LFI attacks via the "woocs" shortcode.
PLUGIN
Before 1
CVE-2021-24566
Risk Score
Threat Entry
Updated 2025-06-17
CVE-2021-25117 - Before 1 Plugin
The WP-PostRatings WordPress plugin before 1.86.1 does not sanitise the postratings_image parameter from its options page (wp-admin/admin.php?page=wp-postratings/postratings-options.php). Even though the page is only accessible to administrators, and protected against CSRF attacks, the issue is still exploitable when the unfiltered_html capability is disabled.
PLUGIN
Before 1
CVE-2021-25117
Risk Score
Threat Entry
Updated 2025-06-20
CVE-2021-24151 - Before 1 Plugin
The WP Editor WordPress plugin before 1.2.7 did not sanitise or validate its setting fields leading to an authenticated (admin+) blind SQL injection issue via an arbitrary parameter when making a request to save the settings.
PLUGIN
Before 1
CVE-2021-24151
Risk Score
Threat Entry
Updated 2025-06-18
CVE-2023-6505 - Before 1 Plugin
The Migrate WordPress Website & Backups WordPress plugin before 1.9.3 does not prevent directory listing in sensitive directories containing export files.
PLUGIN
Before 1
CVE-2023-6505
Risk Score
Threat Entry
Updated 2025-06-18
CVE-2023-6555 - Before 1 Plugin
The Email Subscription Popup WordPress plugin before 1.2.20 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
PLUGIN
Before 1
CVE-2023-6555
Risk Score
Threat Entry
Updated 2025-06-11
CVE-2023-5235 - Before 1 Plugin
The Ovic Responsive WPBakery WordPress plugin before 1.2.9 does not limit which options can be updated via some of its AJAX actions, which may allow attackers with a subscriber+ account to update blog options, such as 'users_can_register' and 'default_role'. It also unserializes user input in the process, which may lead to Object Injection attacks.
PLUGIN
Before 1
CVE-2023-5235
Risk Score
Threat Entry
Updated 2025-06-11
CVE-2023-6271 - Before 1 Plugin
The Backup Migration WordPress plugin before 1.3.6 stores in-progress backups information in easy to find, publicly-accessible files, which may allow attackers monitoring those to leak sensitive information from the site's backups.
PLUGIN
Before 1
CVE-2023-6271
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-5674 - Before 1 Plugin
The WP Mail Log WordPress plugin before 1.1.3 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as Contributor.
PLUGIN
Before 1
CVE-2023-5674
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-6114 - Before 1 Plugin
The Duplicator WordPress plugin before 1.5.7.1, Duplicator Pro WordPress plugin before 4.5.14.2 does not disallow listing the `backups-dup-lite/tmp` directory (or the `backups-dup-pro/tmp` directory in the Pro version), which temporarily stores files containing sensitive data. When directory listing is enabled in the web server, this allows unauthenticated attackers to discover and access these sensitive files, which include a full database dump and a zip archive of the site.
PLUGIN
Before 1
CVE-2023-6114
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-6268 - Before 1 Plugin
The JSON Content Importer WordPress plugin before 1.5.4 does not sanitise and escape the tab parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
PLUGIN
Before 1
CVE-2023-6268
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-5673 - Before 1 Plugin
The WP Mail Log WordPress plugin before 1.1.3 does not properly validate file extensions uploading files to attach to emails, allowing attackers to upload PHP files, leading to remote code execution.
PLUGIN
Before 1
CVE-2023-5673
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-5645 - Before 1 Plugin
The WP Mail Log WordPress plugin before 1.1.3 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as Contributor.
PLUGIN
Before 1
CVE-2023-5645
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-5644 - Before 1 Plugin
The WP Mail Log WordPress plugin before 1.1.3 does not correctly authorize its REST API endpoints, allowing users with the Contributor role to view and delete data that should only be accessible to Admin users.
PLUGIN
Before 1
CVE-2023-5644
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-5203 - Before 1 Plugin
The WP Sessions Time Monitoring Full Automatic WordPress plugin before 1.0.9 does not sanitize the request URL or query parameters before using them in an SQL query, allowing unauthenticated attackers to extract sensitive data from the database via blind time based SQL injection techniques, or in some cases an error/union based technique.
PLUGIN
Before 1
CVE-2023-5203
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-5672 - Before 1 Plugin
The WP Mail Log WordPress plugin before 1.1.3 does not properly validate file path parameters when attaching files to emails, leading to local file inclusion, and allowing an attacker to leak the contents of arbitrary files.
PLUGIN
Before 1
CVE-2023-5672
Risk Score