Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2025-04-17
CVE-2025-1762 - Before 2 Plugin
The Event Tickets with Ticket Scanner WordPress plugin before 2.5.4 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
PLUGIN
Before 2
CVE-2025-1762
Risk Score
Threat Entry
Updated 2025-05-06
CVE-2025-1452 - Before 2 Plugin
The Favorites WordPress plugin before 2.3.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
PLUGIN
Before 2
CVE-2025-1452
Risk Score
Threat Entry
Updated 2025-05-06
CVE-2024-13118 - Before 2 Plugin
The IP Based Login WordPress plugin before 2.4.1 does not have CSRF checks in some places, which could allow attackers to make logged in users delete all logs via a CSRF attack
PLUGIN
Before 2
CVE-2024-13118
Risk Score
Threat Entry
Updated 2025-04-29
CVE-2024-11503 - Before 2 Plugin
The WP Tabs WordPress plugin before 2.2.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
PLUGIN
Before 2
CVE-2024-11503
Risk Score
Threat Entry
Updated 2025-05-15
CVE-2024-11273 - Before 2 Plugin
The Contact Form & SMTP Plugin for WordPress by PirateForms WordPress plugin before 2.6.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
PLUGIN
Before 2
CVE-2024-11273
Risk Score
Threat Entry
Updated 2025-05-15
CVE-2024-11272 - Before 2 Plugin
The Contact Form & SMTP Plugin for WordPress by PirateForms WordPress plugin before 2.6.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
PLUGIN
Before 2
CVE-2024-11272
Risk Score
Threat Entry
Updated 2025-05-15
CVE-2024-10703 - Before 2 Plugin
The Registrations for the Events Calendar WordPress plugin before 2.13.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
PLUGIN
Before 2
CVE-2024-10703
Risk Score
Threat Entry
Updated 2025-04-02
CVE-2024-10105 - Before 2 Plugin
The Job Postings WordPress plugin before 2.7.11 does not sanitise and escape some of its settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
PLUGIN
Before 2
CVE-2024-10105
Risk Score
Threat Entry
Updated 2025-05-15
CVE-2024-13571 - Before 2 Plugin
The Post Timeline WordPress plugin before 2.3.10 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
PLUGIN
Before 2
CVE-2024-13571
Risk Score
Threat Entry
Updated 2025-05-07
CVE-2024-13314 - Before 2 Plugin
The Carousel, Slider, Gallery by WP Carousel WordPress plugin before 2.7.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
PLUGIN
Before 2
CVE-2024-13314
Risk Score
Threat Entry
Updated 2025-06-09
CVE-2024-12163 - Before 2 Plugin
The goodlayers-core WordPress plugin before 2.1.3 allows users with a subscriber role and above to upload SVGs containing malicious payloads.
PLUGIN
Before 2
CVE-2024-12163
Risk Score
Threat Entry
Updated 2025-05-11
CVE-2024-10309 - Before 2 Plugin
The Tracking Code Manager WordPress plugin before 2.4.0 does not sanitise and escape some of its metabox settings when outputing them in the page, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks.
PLUGIN
Before 2
CVE-2024-10309
Risk Score
Threat Entry
Updated 2025-05-14
CVE-2024-12585 - Before 2 Plugin
The Property Hive WordPress plugin before 2.1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
PLUGIN
Before 2
CVE-2024-12585
Risk Score
Threat Entry
Updated 2025-05-14
CVE-2024-10151 - Before 2 Plugin
The Auto iFrame WordPress plugin before 2.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
PLUGIN
Before 2
CVE-2024-10151
Risk Score
Threat Entry
Updated 2025-06-05
CVE-2024-11357 - Before 2 Plugin
The goodlayers-core WordPress plugin before 2.0.10 does not sanitise and escape some of its settings, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
PLUGIN
Before 2
CVE-2024-11357
Risk Score
Threat Entry
Updated 2025-05-14
CVE-2024-10903 - Before 2 Plugin
The Broken Link Checker WordPress plugin before 2.4.2 does not validate a the link URLs before making a request to them, which could allow admin users to perform SSRF attack, for example on a multisite installation.
PLUGIN
Before 2
CVE-2024-10903
Risk Score
Threat Entry
Updated 2025-05-07
CVE-2024-9641 - Before 2 Plugin
The LuckyWP Table of Contents WordPress plugin before 2.1.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
PLUGIN
Before 2
CVE-2024-9641
Risk Score
Threat Entry
Updated 2025-05-17
CVE-2024-10499 - Before 2 Plugin
The AI Engine WordPress plugin before 2.6.5 does not sanitize and escape a parameter from one of its RESP API endpoint before using it in a SQL statement, allowing admins to perform SQL injection attacks
PLUGIN
Before 2
CVE-2024-10499
Risk Score
Threat Entry
Updated 2025-05-17
CVE-2024-11107 - Before 2 Plugin
The System Dashboard WordPress plugin before 2.8.15 does not sanitise and escape some parameters when outputting them in the page, which could allow unauthenticated users to perform Cross-Site Scripting attacks.
PLUGIN
Before 2
CVE-2024-11107
Risk Score
Threat Entry
Updated 2025-05-17
CVE-2024-10708 - Before 2 Plugin
The System Dashboard WordPress plugin before 2.8.15 does not validate user input used in a path, which could allow high privilege users such as admin to perform path traversal attacks an read arbitrary files on the server
PLUGIN
Before 2
CVE-2024-10708
Risk Score