Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2025-12-19
CVE-2025-13307 - Before 2 Plugin
The Ocean Modal Window WordPress plugin before 2.3.3 is vulnerable to Remote Code Execution via the modal display logic. These modals can be displayed under user-controlled conditions that Editors and Administrators can set (edit_pages capability). The conditions are then executed as part of an eval statement executed on every site page. This leads to remote code execution.
PLUGIN
Before 2
CVE-2025-13307
Risk Score
Threat Entry
Updated 2025-12-12
CVE-2025-12841 - Before 2 Plugin
The Bookit WordPress plugin before 2.5.1 has a publicly accessible REST endpoint that allows unauthenticated update of the plugins Stripe payment options.
PLUGIN
Before 2
CVE-2025-12841
Risk Score
Threat Entry
Updated 2025-12-12
CVE-2025-13073 - Before 2 Plugin
The HandL UTM Grabber / Tracker WordPress plugin before 2.8.1 does not sanitize and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
PLUGIN
Before 2
CVE-2025-13073
Risk Score
Threat Entry
Updated 2025-12-12
CVE-2025-13072 - Before 2 Plugin
The HandL UTM Grabber / Tracker WordPress plugin before 2.8.1 does not sanitize and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
PLUGIN
Before 2
CVE-2025-13072
Risk Score
Threat Entry
Updated 2025-12-12
CVE-2025-13031 - Before 2 Plugin
The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.13 does not sanitize and escape some of its settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks
PLUGIN
Before 2
CVE-2025-13031
Risk Score
Threat Entry
Updated 2026-01-09
CVE-2025-12954 - Before 2 Plugin
The Timetable and Event Schedule by MotoPress WordPress plugin before 2.4.16 does not verify a user has access to a specific event when duplicating, leading to arbitrary event disclosure when to users with a role as low as Contributor.
PLUGIN
Before 2
CVE-2025-12954
Risk Score
Threat Entry
Updated 2025-11-25
CVE-2025-12394 - Before 2 Plugin
The Backup Migration WordPress plugin before 2.0.0 does not properly generate its backup path in certain server configurations, allowing unauthenticated users to fetch a log that discloses the backup filename. The backup archive is then downloadable without authentication.
PLUGIN
Before 2
CVE-2025-12394
Risk Score
Threat Entry
Updated 2025-11-18
CVE-2025-9501 - Before 2 Plugin
The W3 Total Cache WordPress plugin before 2.8.13 is vulnerable to command injection via the _parse_dynamic_mfunc function, allowing unauthenticated users to execute PHP commands by submitting a comment with a malicious payload to a post.
PLUGIN
Before 2
CVE-2025-9501
Risk Score
Threat Entry
Updated 2025-12-05
CVE-2025-11154 - Before 2 Plugin
The IDonate WordPress plugin before 2.1.13 does not have authorisation and CSRF when deleting users via an action handler, allowing unauthenticated attackers to delete arbitrary users.
PLUGIN
Before 2
CVE-2025-11154
Risk Score
Threat Entry
Updated 2026-01-09
CVE-2025-9978 - Before 2 Plugin
The Jeg Kit for Elementor WordPress plugin before 2.7.0 does not sanitize SVG file contents when uploaded via xmlrpc.php, leading to a cross site scripting vulnerability.
PLUGIN
Before 2
CVE-2025-9978
Risk Score
Threat Entry
Updated 2025-10-14
CVE-2025-8594 - Before 2 Plugin
The Pz-LinkCard WordPress plugin before 2.5.7 does not validate a parameter before making a request to it, which could allow users with a role as low as Contributor to perform SSRF attack.
PLUGIN
Before 2
CVE-2025-8594
Risk Score
Threat Entry
Updated 2025-10-14
CVE-2025-10357 - Before 2 Plugin
The Simple SEO WordPress plugin before 2.0.32 does not sanitise and escape some parameters when outputing them in the page, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks.
PLUGIN
Before 2
CVE-2025-10357
Risk Score
Threat Entry
Updated 2025-11-13
CVE-2025-10124 - Before 2 Plugin
The Booking Manager WordPress plugin before 2.1.15 registers a shortcode that deletes bookings and makes that shortcode available to anyone with contributor and above privileges. When a page containing the shortcode is visited, the bookings are deleted.
PLUGIN
Before 2
CVE-2025-10124
Risk Score
Threat Entry
Updated 2025-10-06
CVE-2025-9710 - Before 2 Plugin
The Responsive Lightbox & Gallery WordPress plugin before 2.5.3 does not properly handle HTML tag attributes modifications, potentially allowing unauthenticated attackers to abuse the functionality to include event handlers and conduct Stored XSS attacks.
PLUGIN
Before 2
CVE-2025-9710
Risk Score
Threat Entry
Updated 2025-10-06
CVE-2025-9703 - Before 2 Plugin
The Ultimate Addons for Elementor (Formerly Elementor Header & Footer Builder) WordPress plugin before 2.5.0 does not sanitize SVG file contents when uploaded through the xmlrpc.php endpoint using base64 encode, leading to a Cross-Site Scripting vulnerability.
PLUGIN
Before 2
CVE-2025-9703
Risk Score
Threat Entry
Updated 2025-09-22
CVE-2025-8942 - Before 2 Plugin
The WP Hotel Booking WordPress plugin before 2.2.3 lacks proper server-side validation for review ratings, allowing an attacker to manipulate the rating value (e.g., sending negative or out-of-range values) by intercepting and modifying requests.
PLUGIN
Before 2
CVE-2025-8942
Risk Score
Threat Entry
Updated 2026-01-09
CVE-2025-6200 - Before 2 Plugin
The GeoDirectory WordPress plugin before 2.8.120 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
PLUGIN
Before 2
CVE-2025-6200
Risk Score
Threat Entry
Updated 2025-07-01
CVE-2025-5093 - Before 2 Plugin
The Responsive Lightbox & Gallery WordPress plugin before 2.5.2 use the Swipebox library which does not validate and escape title attributes before outputting them back in a page/post where used, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
PLUGIN
Before 2
CVE-2025-5093
Risk Score
Threat Entry
Updated 2025-07-01
CVE-2025-5035 - Before 2 Plugin
The Firelight Lightbox WordPress plugin before 2.3.16 does not sanitise and escape title attributes before outputting them in the page, which could allow users with a role as low as contributors to perform stored Cross-Site Scripting attacks.
PLUGIN
Before 2
CVE-2025-5035
Risk Score
Threat Entry
Updated 2025-07-07
CVE-2025-5194 - Before 2 Plugin
The WP Map Block WordPress plugin before 2.0.3 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
PLUGIN
Before 2
CVE-2025-5194
Risk Score