Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2025-04-23
CVE-2023-5798 - Before 1 Plugin
The Assistant WordPress plugin before 1.4.4 does not validate a parameter before making a request to it via wp_remote_get(), which could allow users with a role as low as Editor to perform SSRF attacks
PLUGIN
Before 1
CVE-2023-5798
Risk Score
Threat Entry
Updated 2025-04-23
CVE-2023-4861 - Before 1 Plugin
The File Manager Pro WordPress plugin before 1.8.1 allows admin users to upload arbitrary files, even in environments where such a user should not be able to gain full control of the server, such as a multisite installation. This leads to remote code execution.
PLUGIN
Before 1
CVE-2023-4861
Risk Score
Threat Entry
Updated 2025-04-23
CVE-2023-5087 - Before 1 Plugin
The Page Builder: Pagelayer WordPress plugin before 1.7.8 doesn't prevent attackers with author privileges and higher from inserting malicious JavaScript inside a post's header or footer code.
PLUGIN
Before 1
CVE-2023-5087
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-5057 - Before 1 Plugin
The ActivityPub WordPress plugin before 1.0.0 does not escape user metadata before outputting them in mentions, which could allow users with a role of Contributor and above to perform Stored XSS attacks
PLUGIN
Before 1
CVE-2023-5057
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-4862 - Before 1 Plugin
The File Manager Pro WordPress plugin before 1.8.1 does not adequately validate and escape some inputs, leading to XSS by high-privilege users.
PLUGIN
Before 1
CVE-2023-4862
Risk Score
Threat Entry
Updated 2025-04-23
CVE-2023-4819 - Before 1 Plugin
The Shared Files WordPress plugin before 1.7.6 does not return the right Content-Type header for the specified uploaded file. Therefore, an attacker can upload an allowed file extension injected with malicious scripts.
PLUGIN
Before 1
CVE-2023-4819
Risk Score
Threat Entry
Updated 2025-04-23
CVE-2023-4687 - Before 1 Plugin
The Page Builder: Pagelayer WordPress plugin before 1.7.7 doesn't prevent unauthenticated attackers from updating a post's header or footer code on scheduled posts.
PLUGIN
Before 1
CVE-2023-4687
Risk Score
Threat Entry
Updated 2025-04-23
CVE-2023-4821 - Before 1 Plugin
The Drag and Drop Multiple File Upload for WooCommerce WordPress plugin before 1.1.1 does not filter all potentially dangerous file extensions. Therefore, an attacker can upload unsafe .shtml or .svg files containing malicious scripts.
PLUGIN
Before 1
CVE-2023-4821
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-4798 - Before 1 Plugin
The User Avatar WordPress plugin before 1.2.2 does not properly sanitize and escape certain of its shortcodes attributes, which could allow relatively low-privileged users like contributors to conduct Stored XSS attacks.
PLUGIN
Before 1
CVE-2023-4798
Risk Score
Threat Entry
Updated 2025-04-23
CVE-2023-4795 - Before 1 Plugin
The Testimonial Slider Shortcode WordPress plugin before 1.1.9 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin
PLUGIN
Before 1
CVE-2023-4795
Risk Score
Threat Entry
Updated 2025-04-23
CVE-2023-4725 - Before 1 Plugin
The Simple Posts Ticker WordPress plugin before 1.1.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
PLUGIN
Before 1
CVE-2023-4725
Risk Score
Threat Entry
Updated 2025-04-23
CVE-2023-4666 - Before 1 Plugin
The Form Maker by 10Web WordPress plugin before 1.15.20 does not validate signatures when creating them on the server from user input, allowing unauthenticated users to create arbitrary files and lead to RCE
PLUGIN
Before 1
CVE-2023-4666
Risk Score
Threat Entry
Updated 2025-04-23
CVE-2023-4646 - Before 1 Plugin
The Simple Posts Ticker WordPress plugin before 1.1.6 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
PLUGIN
Before 1
CVE-2023-4646
Risk Score
Threat Entry
Updated 2025-04-23
CVE-2023-3746 - Before 1 Plugin
The ActivityPub WordPress plugin before 1.0.0 does not sanitize and escape some data from post content, which could allow contributor and above role to perform Stored Cross-Site Scripting attacks
PLUGIN
Before 1
CVE-2023-3746
Risk Score
Threat Entry
Updated 2025-04-23
CVE-2023-3707 - Before 1 Plugin
The ActivityPub WordPress plugin before 1.0.0 does not ensure that post contents to be displayed are public and belong to the plugin, allowing any authenticated user, such as subscriber to retrieve the content of arbitrary post (such as draft and private) via an IDOR vector. Password protected posts are not affected by this issue.
PLUGIN
Before 1
CVE-2023-3707
Risk Score
Threat Entry
Updated 2025-04-23
CVE-2023-3706 - Before 1 Plugin
The ActivityPub WordPress plugin before 1.0.0 does not ensure that post titles to be displayed are public and belong to the plugin, allowing any authenticated user, such as subscriber to retrieve the title of arbitrary post (such as draft and private) via an IDOR vector
PLUGIN
Before 1
CVE-2023-3706
Risk Score
Threat Entry
Updated 2025-04-23
CVE-2023-4827 - Before 1 Plugin
The File Manager Pro WordPress plugin before 1.8 does not properly check the CSRF nonce in the `fs_connector` AJAX action. This allows attackers to make highly privileged users perform unwanted file system actions via CSRF attacks by using GET requests, such as uploading a web shell.
PLUGIN
Before 1
CVE-2023-4827
Risk Score
Threat Entry
Updated 2025-05-02
CVE-2023-4294 - Before 1 Plugin
The URL Shortify WordPress plugin before 1.7.6 does not properly escape the value of the referer header, thus allowing an unauthenticated attacker to inject malicious javascript that will trigger in the plugins admin panel with statistics of the created short link.
PLUGIN
Before 1
CVE-2023-4294
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-2705 - Before 1 Plugin
The gAppointments WordPress plugin before 1.10.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against admin
PLUGIN
Before 1
CVE-2023-2705
Risk Score
Threat Entry
Updated 2025-04-23
CVE-2023-4279 - Before 1 Plugin
This User Activity Log WordPress plugin before 1.6.7 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate its value. This may be used to hide the source of malicious traffic.
PLUGIN
Before 1
CVE-2023-4279
Risk Score