Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2024-11-21
CVE-2021-25121 - Before 1 Plugin
The Rating by BestWebSoft WordPress plugin before 1.6 does not validate the submitted rating, allowing submission of long integer, causing a Denial of Service on the post/page when a user submit such rating
PLUGIN
Before 1
CVE-2021-25121
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-1266 - Before 1 Plugin
The Post Grid, Slider & Carousel Ultimate WordPress plugin before 1.5.0 does not sanitise and escape the Header Title, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
PLUGIN
Before 1
CVE-2022-1266
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-25104 - Before 1 Plugin
The Ocean Extra WordPress plugin before 1.9.5 does not escape generated links which are then used when the OceanWP is active, leading to a Reflected Cross-Site Scripting issue
PLUGIN
Before 1
CVE-2021-25104
Risk Score
Threat Entry
Updated 2025-01-31
CVE-2022-0209 - Before 1 Plugin
The Mitsol Social Post Feed WordPress plugin before 1.11 does not escape some of its settings before outputting them back in attributes, which could allow high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
PLUGIN
Before 1
CVE-2022-0209
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-1800 - Before 1 Plugin
The Export any WordPress data to XML/CSV WordPress plugin before 1.3.5 does not sanitize the cpt POST parameter when exporting post data before using it in a database query, leading to an SQL injection vulnerability.
PLUGIN
Before 1
CVE-2022-1800
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-1777 - Before 1 Plugin
The Filr WordPress plugin before 1.2.2.1 does not have authorisation check in two of its AJAX actions, allowing them to be called by any authenticated users, such as subscriber. They are are protected with a nonce, however the nonce is leaked on the dashboard. This could allow them to upload arbitrary HTML files as well as delete all files or arbitrary ones.
PLUGIN
Before 1
CVE-2022-1777
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-1762 - Before 1 Plugin
The iQ Block Country WordPress plugin before 1.2.20 does not properly checks HTTP headers in order to validate the origin IP address, allowing threat actors to bypass it's block feature by spoofing the headers.
PLUGIN
Before 1
CVE-2022-1762
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-1604 - Before 1 Plugin
The MailerLite WordPress plugin before 1.5.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting
PLUGIN
Before 1
CVE-2022-1604
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-1710 - Before 1 Plugin
The Appointment Hour Booking WordPress plugin before 1.3.56 does not sanitise and escape a settings of its Calendar fields, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed.
PLUGIN
Before 1
CVE-2022-1710
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-1532 - Before 1 Plugin
Themify WordPress plugin before 1.3.8 does not sanitise and escape the page parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting
PLUGIN
Before 1
CVE-2022-1532
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-0626 - Before 1 Plugin
The Advanced Admin Search WordPress plugin before 1.1.6 does not sanitize and escape some parameters before outputting them back in an admin page, leading to a Reflected Cross-Site Scripting.
PLUGIN
Before 1
CVE-2022-0626
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-1335 - Before 1 Plugin
The Slideshow CK WordPress plugin before 1.4.10 does not sanitize and escape Slide's descriptions, which could allow high-privileged users such as admin to perform Cross-Site Scripting attacks when unfiltered_html is disallowed
PLUGIN
Before 1
CVE-2022-1335
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-1692 - Before 1 Plugin
The CP Image Store with Slideshow WordPress plugin before 1.0.68 does not sanitise and escape the ordering_by query parameter before using it in a SQL statement in pages where the [codepeople-image-store] is embed, allowing unauthenticated users to perform an SQL injection attack
PLUGIN
Before 1
CVE-2022-1692
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-1673 - Before 1 Plugin
The WooCommerce Green Wallet Gateway WordPress plugin before 1.0.2 does not escape the error_envision query parameter before outputting it to the page, leading to a Reflected Cross-Site Scripting vulnerability.
PLUGIN
Before 1
CVE-2022-1673
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-1691 - Before 1 Plugin
The Realty Workstation WordPress plugin before 1.0.15 does not sanitise and escape the trans_edit parameter before using it in a SQL statement when an agent edit a transaction, leading to an SQL injection
PLUGIN
Before 1
CVE-2022-1691
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-1647 - Before 1 Plugin
The FormCraft WordPress plugin before 1.2.6 does not sanitise and escape Field Labels, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
PLUGIN
Before 1
CVE-2022-1647
Risk Score
Threat Entry
Updated 2024-12-05
CVE-2022-0788 - Before 1 Plugin
The WP Fundraising Donation and Crowdfunding Platform WordPress plugin before 1.5.0 does not sanitise and escape a parameter before using it in a SQL statement via one of it's REST route, leading to an SQL injection exploitable by unauthenticated users
PLUGIN
Before 1
CVE-2022-0788
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-1570 - Before 1 Plugin
The Files Download Delay WordPress plugin before 1.0.7 does not have authorisation and CSRF checks when reseting its settings, which could allow any authenticated users, such as subscriber to perform such action.
PLUGIN
Before 1
CVE-2022-1570
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-1569 - Before 1 Plugin
The Drag & Drop Builder, Human Face Detector, Pre-built Templates, Spam Protection, User Email Notifications & more! WordPress plugin before 1.4.9.4 does not sanitise and escape some of its form fields, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks when unfiltered_html is disallowed
PLUGIN
Before 1
CVE-2022-1569
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-1541 - Before 1 Plugin
The Video Slider WordPress plugin before 1.4.8 does not sanitize or escape some of its video settings, which could allow high-privileged users to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
PLUGIN
Before 1
CVE-2022-1541
Risk Score