Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2024-11-21
CVE-2022-2169 - Before 1 Plugin
The Loading Page with Loading Screen WordPress plugin before 1.0.83 does not escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
PLUGIN
Before 1
CVE-2022-2169
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-2114 - Before 1 Plugin
The Data Tables Generator by Supsystic WordPress plugin before 1.10.20 does not sanitise and escape some of its Table settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)
PLUGIN
Before 1
CVE-2022-2114
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-2100 - Before 1 Plugin
The Page Generator WordPress plugin before 1.6.5 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
PLUGIN
Before 1
CVE-2022-2100
Risk Score
Threat Entry
Updated 2026-01-23
CVE-2022-1952 - Before 1 Plugin
The Free Booking Plugin for Hotels, Restaurant and Car Rental WordPress plugin before 1.1.16 suffers from insufficient input validation which leads to arbitrary file upload and subsequently to remote code execution. An AJAX action accessible to unauthenticated users is affected by this issue. An allowlist of valid file extensions is defined but is not used during the validation steps.
PLUGIN
Before 1
CVE-2022-1952
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-2093 - Before 1 Plugin
The WP Duplicate Page WordPress plugin before 1.3 does not sanitize and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed.
PLUGIN
Before 1
CVE-2022-2093
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-1957 - Before 1 Plugin
The Comment License WordPress plugin before 1.4.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
PLUGIN
Before 1
CVE-2022-1957
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-1937 - Before 1 Plugin
The Awin Data Feed WordPress plugin before 1.8 does not sanitise and escape a parameter before outputting it back via an AJAX action (available to both unauthenticated and authenticated users), leading to a Reflected Cross-Site Scripting
PLUGIN
Before 1
CVE-2022-1937
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-1938 - Before 1 Plugin
The Awin Data Feed WordPress plugin before 1.8 does not sanitise and escape a header when processing request to generate analytics data, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against a logged in admin viewing the plugin's settings
PLUGIN
Before 1
CVE-2022-1938
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-1953 - Before 1 Plugin
The Product Configurator for WooCommerce WordPress plugin before 1.2.32 suffers from an arbitrary file deletion vulnerability via an AJAX action, accessible to unauthenticated users, which accepts user input that is being used in a path and passed to unlink() without validation first
PLUGIN
Before 1
CVE-2022-1953
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-1916 - Before 1 Plugin
The Active Products Tables for WooCommerce. Professional products tables for WooCommerce store WordPress plugin before 1.0.5 does not sanitise and escape a parameter before outputting it back in the response of an AJAX action (available to both unauthenticated and authenticated users), leading to a Reflected cross-Site Scripting
PLUGIN
Before 1
CVE-2022-1916
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-1994 - Before 1 Plugin
The Login With OTP Over SMS, Email, WhatsApp and Google Authenticator WordPress plugin before 1.0.8 does not escape its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed
PLUGIN
Before 1
CVE-2022-1994
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-1327 - Before 1 Plugin
The Image Gallery WordPress plugin before 1.1.6 does not sanitize and escape some of its Image fields, which could allow high-privileged users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
PLUGIN
Before 1
CVE-2022-1327
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-1845 - Before 1 Plugin
The WP Post Styling WordPress plugin before 1.3.1 does not have CSRF checks in various actions, which could allow attackers to make a logged in admin delete plugin's data, update the settings, add new entries and more via CSRF attacks
PLUGIN
Before 1
CVE-2022-1845
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-1010 - Before 1 Plugin
The Login using WordPress Users ( WP as SAML IDP ) WordPress plugin before 1.13.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)
PLUGIN
Before 1
CVE-2022-1010
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-0875 - Before 1 Plugin
The Google Authenticator WordPress plugin before 1.0.5 does not have CSRF check when saving its settings, and does not sanitise as well as escape them, allowing attackers to make a logged in admin change them and perform Cross-Site Scripting attacks
PLUGIN
Before 1
CVE-2022-0875
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-1939 - Before 1 Plugin
The Allow svg files WordPress plugin before 1.1 does not properly validate uploaded files, which could allow high privilege users such as admin to upload PHP files even when they are not allowed to
PLUGIN
Before 1
CVE-2022-1939
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-1945 - Before 1 Plugin
The Coming Soon & Maintenance Mode by Colorlib WordPress plugin before 1.0.99 does not sanitize and escape some settings, allowing high privilege users such as admin to perform Stored Cross-Site Scripting when unfiltered_html is disallowed (for example in multisite setup)
PLUGIN
Before 1
CVE-2022-1945
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-1896 - Before 1 Plugin
The underConstruction WordPress plugin before 1.21 does not sanitise or escape the "Display a custom page using your own HTML" setting before outputting it, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiletred_html capability is disallowed.
PLUGIN
Before 1
CVE-2022-1896
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-1895 - Before 1 Plugin
The underConstruction WordPress plugin before 1.20 does not have CSRF check in place when deactivating the construction mode, which could allow attackers to make a logged in admin perform such action via a CSRF attack
PLUGIN
Before 1
CVE-2022-1895
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-1472 - Before 1 Plugin
The Better Find and Replace WordPress plugin before 1.3.6 does not properly sanitise, validate and escape various parameters before using them in an SQL statement, leading to an SQL Injection
PLUGIN
Before 1
CVE-2022-1472
Risk Score