Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2025-05-29
CVE-2023-5953 - Before 2 Plugin
The Welcart e-Commerce WordPress plugin before 2.9.5 does not validate files to be uploaded, as well as does not have authorisation and CSRF in an AJAX action handling such upload. As a result, any authenticated users, such as subscriber could upload arbitrary files, such as PHP on the server
PLUGIN
Before 2
CVE-2023-5953
Risk Score
Threat Entry
Updated 2025-02-20
CVE-2023-5951 - Before 2 Plugin
The Welcart e-Commerce WordPress plugin before 2.9.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
PLUGIN
Before 2
CVE-2023-5951
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-5604 - Before 2 Plugin
The Asgaros Forum WordPress plugin before 2.7.1 allows forum administrators, who may not be WordPress (super-)administrators, to set insecure configuration that allows unauthenticated users to upload dangerous files (e.g. .php, .phtml), potentially leading to remote code execution.
PLUGIN
Before 2
CVE-2023-5604
Risk Score
Threat Entry
Updated 2025-06-04
CVE-2023-5958 - Before 2 Plugin
The POST SMTP Mailer WordPress plugin before 2.7.1 does not escape email message content before displaying it in the backend, allowing an unauthenticated attacker to perform XSS attacks against highly privileged users.
PLUGIN
Before 2
CVE-2023-5958
Risk Score
Threat Entry
Updated 2025-01-16
CVE-2023-5611 - Before 2 Plugin
The Seraphinite Accelerator WordPress plugin before 2.20.32 does not have authorisation and CSRF checks when resetting and importing its settings, allowing unauthenticated users to reset them
PLUGIN
Before 2
CVE-2023-5611
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-5559 - Before 2 Plugin
The 10Web Booster WordPress plugin before 2.24.18 does not validate the option name given to some AJAX actions, allowing unauthenticated users to delete arbitrary options from the database, leading to denial of service.
PLUGIN
Before 2
CVE-2023-5559
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-5239 - Before 2 Plugin
The Security & Malware scan by CleanTalk WordPress plugin before 2.121 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate its value. This may be used to bypass bruteforce protection.
PLUGIN
Before 2
CVE-2023-5239
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-5560 - Before 2 Plugin
The WP-UserOnline WordPress plugin before 2.88.3 does not sanitise and escape the X-Forwarded-For header before outputting its content on the page, which allows unauthenticated users to perform Cross-Site Scripting attacks.
PLUGIN
Before 2
CVE-2023-5560
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-5325 - Before 2 Plugin
The Woocommerce Vietnam Checkout WordPress plugin before 2.0.6 does not escape the custom shipping phone field no the checkout form leading to XSS
PLUGIN
Before 2
CVE-2023-5325
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-5525 - Before 2 Plugin
The Limit Login Attempts Reloaded WordPress plugin before 2.25.26 is missing authorization on the `toggle_auto_update` AJAX action, allowing any user with a valid nonce to toggle the auto-update status of the plugin.
PLUGIN
Before 2
CVE-2023-5525
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-5652 - Before 2 Plugin
The WP Hotel Booking WordPress plugin before 2.0.8 does not have authorisation and CSRF checks, as well as does not escape user input before using it in a SQL statement of a function hooked to admin_init, allowing unauthenticated users to perform SQL injections
PLUGIN
Before 2
CVE-2023-5652
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-5799 - Before 2 Plugin
The WP Hotel Booking WordPress plugin before 2.0.8 does not have proper authorisation when deleting a package, allowing Contributor and above roles to delete posts that do no belong to them
PLUGIN
Before 2
CVE-2023-5799
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-5340 - Before 2 Plugin
The Five Star Restaurant Menu and Food Ordering WordPress plugin before 2.4.11 unserializes user input via an AJAX action available to unauthenticated users, allowing them to perform PHP Object Injection when a suitable gadget is present on the blog.
PLUGIN
Before 2
CVE-2023-5340
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-5609 - Before 2 Plugin
The Seraphinite Accelerator WordPress plugin before 2.2.29 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
PLUGIN
Before 2
CVE-2023-5609
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-5651 - Before 2 Plugin
The WP Hotel Booking WordPress plugin before 2.0.8 does not have authorisation and CSRF checks, as well as does not ensure that the package to be deleted is a package, allowing any authenticated users, such as subscriber to delete arbitrary posts
PLUGIN
Before 2
CVE-2023-5651
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-5610 - Before 2 Plugin
The Seraphinite Accelerator WordPress plugin before 2.2.29 does not validate the URL to redirect any authenticated user to, leading to an arbitrary redirect
PLUGIN
Before 2
CVE-2023-5610
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-5509 - Before 2 Plugin
The myStickymenu WordPress plugin before 2.6.5 does not adequately authorize some ajax calls, allowing any logged-in user to perform the actions.
PLUGIN
Before 2
CVE-2023-5509
Risk Score
Threat Entry
Updated 2025-02-26
CVE-2023-5454 - Before 2 Plugin
The Templately WordPress plugin before 2.2.6 does not properly authorize the `saved-templates/delete` REST API call, allowing unauthenticated users to delete arbitrary posts.
PLUGIN
Before 2
CVE-2023-5454
Risk Score
Threat Entry
Updated 2025-02-26
CVE-2023-5181 - Before 2 Plugin
The WP Discord Invite WordPress plugin before 2.5.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
PLUGIN
Before 2
CVE-2023-5181
Risk Score
Threat Entry
Updated 2025-04-23
CVE-2023-5098 - Before 2 Plugin
The Campaign Monitor Forms by Optin Cat WordPress plugin before 2.5.6 does not prevent users with low privileges (like subscribers) from overwriting any options on a site with the string "true", which could lead to a variety of outcomes, including DoS.
PLUGIN
Before 2
CVE-2023-5098
Risk Score