Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2025-01-30
CVE-2023-1546 - Before 2 Plugin
The MyCryptoCheckout WordPress plugin before 2.124 does not escape some URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting
PLUGIN
Before 2
CVE-2023-1546
Risk Score
Threat Entry
Updated 2025-01-30
CVE-2023-0891 - Before 2 Plugin
The StagTools WordPress plugin before 2.3.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
PLUGIN
Before 2
CVE-2023-0891
Risk Score
Threat Entry
Updated 2025-01-30
CVE-2023-1090 - Before 2 Plugin
The SMTP Mailing Queue WordPress plugin before 2.0.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
PLUGIN
Before 2
CVE-2023-1090
Risk Score
Threat Entry
Updated 2025-02-04
CVE-2023-1624 - Before 2 Plugin
The WPCode WordPress plugin before 2.0.9 has a flawed CSRF when deleting log, and does not ensure that the file to be deleted is inside the expected folder. This could allow attackers to make users with the wpcode_activate_snippets capability delete arbitrary log files on the server, including outside of the blog folders
PLUGIN
Before 2
CVE-2023-1624
Risk Score
Threat Entry
Updated 2025-02-06
CVE-2023-1371 - Before 2 Plugin
The W4 Post List WordPress plugin before 2.4.6 does not ensure that password protected posts can be accessed before displaying their content, which could allow any authenticated users to access them
PLUGIN
Before 2
CVE-2023-1371
Risk Score
Threat Entry
Updated 2025-02-06
CVE-2023-1373 - Before 2 Plugin
The W4 Post List WordPress plugin before 2.4.6 does not escape some URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting
PLUGIN
Before 2
CVE-2023-1373
Risk Score
Threat Entry
Updated 2025-02-06
CVE-2023-1282 - Before 2 Plugin
The Drag and Drop Multiple File Upload PRO - Contact Form 7 Standard WordPress plugin before 2.11.1 and Drag and Drop Multiple File Upload PRO - Contact Form 7 with Remote Storage Integrations WordPress plugin before 5.0.6.4 do not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high-privilege users such as admins.
PLUGIN
Before 2
CVE-2023-1282
Risk Score
Threat Entry
Updated 2025-02-06
CVE-2023-0889 - Before 2 Plugin
Themeflection Numbers WordPress plugin before 2.0.1 does not have authorisation and CSRF check in an AJAX action, and does not ensure that the options to be updated belong to the plugin. As a result, it could allow any authenticated users, such as subscriber, to update arbitrary blog options, such as enabling registration and set the default role to administrator
PLUGIN
Before 2
CVE-2023-0889
Risk Score
Threat Entry
Updated 2025-02-06
CVE-2023-0374 - Before 2 Plugin
The W4 Post List WordPress plugin before 2.4.6 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
PLUGIN
Before 2
CVE-2023-0374
Risk Score
Threat Entry
Updated 2025-02-11
CVE-2023-1425 - Before 2 Plugin
The WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg WordPress plugin before 2.7.9.4 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admins
PLUGIN
Before 2
CVE-2023-1425
Risk Score
Threat Entry
Updated 2025-02-11
CVE-2023-1122 - Before 2 Plugin
The Simple Giveaways WordPress plugin before 2.45.1 does not sanitise and escape some of its Giveaways options, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
PLUGIN
Before 2
CVE-2023-1122
Risk Score
Threat Entry
Updated 2025-02-11
CVE-2023-1121 - Before 2 Plugin
The Simple Giveaways WordPress plugin before 2.45.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
PLUGIN
Before 2
CVE-2023-1121
Risk Score
Threat Entry
Updated 2025-02-11
CVE-2023-1120 - Before 2 Plugin
The Simple Giveaways WordPress plugin before 2.45.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
PLUGIN
Before 2
CVE-2023-1120
Risk Score
Threat Entry
Updated 2025-02-19
CVE-2023-0823 - Before 2 Plugin
The Cookie Notice & Compliance for GDPR / CCPA WordPress plugin before 2.4.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
PLUGIN
Before 2
CVE-2023-0823
Risk Score
Threat Entry
Updated 2025-02-19
CVE-2023-0504 - Before 2 Plugin
The HT Politic WordPress plugin before 2.3.8 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack
PLUGIN
Before 2
CVE-2023-0504
Risk Score
Threat Entry
Updated 2025-02-19
CVE-2023-0501 - Before 2 Plugin
The WP Insurance WordPress plugin before 2.1.4 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack
PLUGIN
Before 2
CVE-2023-0501
Risk Score
Threat Entry
Updated 2025-02-19
CVE-2023-0336 - Before 2 Plugin
The OoohBoi Steroids for Elementor WordPress plugin before 2.1.5 has CSRF and broken access control vulnerabilities which leads user with role as low as subscriber to delete attachment.
PLUGIN
Before 2
CVE-2023-0336
Risk Score
Threat Entry
Updated 2025-02-26
CVE-2023-0631 - Before 2 Plugin
The Paid Memberships Pro WordPress plugin before 2.9.12 does not prevent subscribers from rendering shortcodes that concatenate attributes directly into an SQL query.
PLUGIN
Before 2
CVE-2023-0631
Risk Score
Threat Entry
Updated 2025-02-27
CVE-2023-0772 - Before 2 Plugin
The Popup Builder by OptinMonster WordPress plugin before 2.12.2 does not ensure that the campaign to be loaded via some shortcodes is actually a campaign, allowing any authenticated users such as subscriber to retrieve the content of arbitrary posts, like draft, private or even password protected ones.
PLUGIN
Before 2
CVE-2023-0772
Risk Score
Threat Entry
Updated 2025-02-27
CVE-2023-0749 - Before 2 Plugin
The Ocean Extra WordPress plugin before 2.1.3 does not ensure that the template to be loaded via a shortcode is actually a template, allowing any authenticated users such as subscriber to retrieve the content of arbitrary posts, such as draft, private or even password protected ones.
PLUGIN
Before 2
CVE-2023-0749
Risk Score