Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2025-06-20
CVE-2023-6005 - Before 2 Plugin
The EventON WordPress plugin before 4.5.5, EventON WordPress plugin before 2.2.7 does not sanitize and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
PLUGIN
Before 2
CVE-2023-6005
Risk Score
Threat Entry
Updated 2025-06-02
CVE-2023-3178 - Before 2 Plugin
The POST SMTP Mailer WordPress plugin before 2.5.7 does not have proper CSRF checks in some AJAX actions, which could allow attackers to make logged in users with the manage_postman_smtp capability delete arbitrary logs via a CSRF attack.
PLUGIN
Before 2
CVE-2023-3178
Risk Score
Threat Entry
Updated 2025-06-13
CVE-2023-0224 - Before 2 Plugin
The GiveWP WordPress plugin before 2.24.1 does not properly escape user input before it reaches SQL queries, which could let unauthenticated attackers perform SQL Injection attacks
PLUGIN
Before 2
CVE-2023-0224
Risk Score
Threat Entry
Updated 2025-06-11
CVE-2023-6991 - Before 2 Plugin
The JSM file_get_contents() Shortcode WordPress plugin before 2.7.1 does not validate one of its shortcode's parameters before making a request to it, which could allow users with contributor role and above to perform SSRF attacks.
PLUGIN
Before 2
CVE-2023-6991
Risk Score
Threat Entry
Updated 2025-06-11
CVE-2023-6029 - Before 2 Plugin
The EazyDocs WordPress plugin before 2.3.6 does not have authorization and CSRF checks when handling documents and does not ensure that they are documents from the plugin, allowing unauthenticated users to delete arbitrary posts, as well as add and delete documents/sections.
PLUGIN
Before 2
CVE-2023-6029
Risk Score
Threat Entry
Updated 2025-06-20
CVE-2023-6620 - Before 2 Plugin
The POST SMTP Mailer WordPress plugin before 2.8.7 does not properly sanitise and escape several parameters before using them in SQL statements, leading to a SQL injection exploitable by high privilege users such as admin.
PLUGIN
Before 2
CVE-2023-6620
Risk Score
Threat Entry
Updated 2025-06-09
CVE-2023-6163 - Before 2 Plugin
The WP Crowdfunding WordPress plugin before 2.1.10 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
PLUGIN
Before 2
CVE-2023-6163
Risk Score
Threat Entry
Updated 2025-06-03
CVE-2023-6843 - Before 2 Plugin
The easy.jobs- Best Recruitment Plugin for Job Board Listing, Manager, Career Page for Elementor & Gutenberg WordPress plugin before 2.4.7 does not properly secure some of its AJAX actions, allowing any logged-in users to modify its settings.
PLUGIN
Before 2
CVE-2023-6843
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-6750 - Before 2 Plugin
The Clone WordPress plugin before 2.4.3 uses buffer files to store in-progress backup informations, which is stored at a publicly accessible, statically defined file path.
PLUGIN
Before 2
CVE-2023-6750
Risk Score
Threat Entry
Updated 2025-04-17
CVE-2023-6383 - Before 2 Plugin
The Debug Log Manager WordPress plugin before 2.3.0 contains a Directory listing vulnerability was discovered, which allows you to download the debug log without authorization and gain access to sensitive data
PLUGIN
Before 2
CVE-2023-6383
Risk Score
Threat Entry
Updated 2025-06-17
CVE-2023-6161 - Before 2 Plugin
The WP Crowdfunding WordPress plugin before 2.1.9 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
PLUGIN
Before 2
CVE-2023-6161
Risk Score
Threat Entry
Updated 2025-06-18
CVE-2023-6621 - Before 2 Plugin
The POST SMTP WordPress plugin before 2.8.7 does not sanitise and escape the msg parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
PLUGIN
Before 2
CVE-2023-6621
Risk Score
Threat Entry
Updated 2025-05-13
CVE-2023-6064 - Before 2 Plugin
The PayHere Payment Gateway WordPress plugin before 2.2.12 automatically creates publicly-accessible log files containing sensitive information when transactions occur.
PLUGIN
Before 2
CVE-2023-6064
Risk Score
Threat Entry
Updated 2025-06-18
CVE-2023-6485 - Before 2 Plugin
The Html5 Video Player WordPress plugin before 2.5.19 does not sanitise and escape some of its player settings, which combined with missing capability checks around the plugin could allow any authenticated users, such as low as subscribers to perform Stored Cross-Site Scripting attacks against high privilege users like admins
PLUGIN
Before 2
CVE-2023-6485
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-6250 - Before 2 Plugin
The BestWebSoft's Like & Share WordPress plugin before 2.74 discloses the content of password protected posts to unauthenticated users via a meta tag
PLUGIN
Before 2
CVE-2023-6250
Risk Score
Threat Entry
Updated 2025-05-07
CVE-2023-5005 - Before 2 Plugin
The Autocomplete Location field Contact Form 7 WordPress plugin before 3.0, autocomplete-location-field-contact-form-7-pro WordPress plugin before 2.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
PLUGIN
Before 2
CVE-2023-5005
Risk Score
Threat Entry
Updated 2025-05-07
CVE-2023-6289 - Before 2 Plugin
The Swift Performance Lite WordPress plugin before 2.3.6.15 does not prevent users from exporting the plugin's settings, which may include sensitive information such as Cloudflare API tokens.
PLUGIN
Before 2
CVE-2023-6289
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-6035 - Before 2 Plugin
The EazyDocs WordPress plugin before 2.3.4 does not properly sanitize and escape "data" parameter before using it in an SQL statement via an AJAX action, which could allow any authenticated users, such as subscribers, to perform SQL Injection attacks.
PLUGIN
Before 2
CVE-2023-6035
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-5757 - Before 2 Plugin
The WP Crowdfunding WordPress plugin before 2.1.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
PLUGIN
Before 2
CVE-2023-5757
Risk Score
Threat Entry
Updated 2025-02-20
CVE-2023-5952 - Before 2 Plugin
The Welcart e-Commerce WordPress plugin before 2.9.5 unserializes user input from cookies, which could allow unautehtniacted users to perform PHP Object Injection when a suitable gadget is present on the blog
PLUGIN
Before 2
CVE-2023-5952
Risk Score