Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2025-05-06
CVE-2024-11183 - Before 2 Plugin
The Simple Side Tab WordPress plugin before 2.2.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
PLUGIN
Before 2
CVE-2024-11183
Risk Score
Threat Entry
Updated 2025-05-17
CVE-2024-10480 - Before 2 Plugin
The 3DPrint Lite WordPress plugin before 2.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack.
PLUGIN
Before 2
CVE-2024-10480
Risk Score
Threat Entry
Updated 2025-04-11
CVE-2024-10104 - Before 2 Plugin
The Jobs for WordPress plugin before 2.7.8 does not sanitise and escape some of its Job settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks
PLUGIN
Before 2
CVE-2024-10104
Risk Score
Threat Entry
Updated 2025-05-15
CVE-2024-7982 - Before 2 Plugin
The Registrations for the Events Calendar WordPress plugin before 2.12.4 does not sanitise and escape some parameters when accepting event registrations, which could allow unauthenticated users to perform Cross-Site Scripting attacks.
PLUGIN
Before 2
CVE-2024-7982
Risk Score
Threat Entry
Updated 2025-05-17
CVE-2024-8378 - Before 2 Plugin
The Safe SVG WordPress plugin before 2.2.6 has its sanitisation code is only running for paths that call wp_handle_upload, but not for example for code that uses wp_handle_sideload which is often used to upload attachments via raw POST data.
PLUGIN
Before 2
CVE-2024-8378
Risk Score
Threat Entry
Updated 2024-10-24
CVE-2024-8625 - Before 2 Plugin
The TS Poll WordPress plugin before 2.4.0 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks
PLUGIN
Before 2
CVE-2024-8625
Risk Score
Threat Entry
Updated 2025-09-30
CVE-2024-8983 - Before 2 Plugin
Custom Twitter Feeds WordPress plugin before 2.2.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
PLUGIN
Before 2
CVE-2024-8983
Risk Score
Threat Entry
Updated 2024-10-07
CVE-2024-7714 - Before 2 Plugin
The AI ChatBot with ChatGPT and Content Generator by AYS WordPress plugin before 2.1.0 lacks sufficient access controls allowing an unauthenticated user to disconnect the AI ChatBot with ChatGPT and Content Generator by AYS WordPress plugin before 2.1.0 from OpenAI, thereby disabling the AI ChatBot with ChatGPT and Content Generator by AYS WordPress plugin before 2.1.0. Multiple actions are accessible: 'ays_chatgpt_disconnect', 'ays_chatgpt_connect', and 'ays_chatgpt_save_feedback'
PLUGIN
Before 2
CVE-2024-7714
Risk Score
Threat Entry
Updated 2025-03-18
CVE-2024-7713 - Before 2 Plugin
The AI ChatBot with ChatGPT and Content Generator by AYS WordPress plugin before 2.1.0 discloses the Open AI API Key, allowing unauthenticated users to obtain it
PLUGIN
Before 2
CVE-2024-7713
Risk Score
Threat Entry
Updated 2026-01-20
CVE-2024-6845 - Before 2 Plugin
The Chatbot with ChatGPT WordPress plugin before 2.4.6 does not have proper authorization in one of its REST endpoint, allowing unauthenticated users to retrieve the encoded key and then decode it, thereby leaking the OpenAI API key
PLUGIN
Before 2
CVE-2024-6845
Risk Score
Threat Entry
Updated 2024-09-27
CVE-2024-7863 - Before 2 Plugin
The Favicon Generator (CLOSED) WordPress plugin before 2.1 does not validate files to be uploaded and does not have CSRF checks, which could allow attackers to make logged in admin upload arbitrary files such as PHP on the server
PLUGIN
Before 2
CVE-2024-7863
Risk Score
Threat Entry
Updated 2024-09-27
CVE-2024-7864 - Before 2 Plugin
The Favicon Generator (CLOSED) WordPress plugin before 2.1 does not have CSRF and path validation in the output_sub_admin_page_0() function, allowing attackers to make logged in admins delete arbitrary files on the server
PLUGIN
Before 2
CVE-2024-7864
Risk Score
Threat Entry
Updated 2024-09-27
CVE-2024-7133 - Before 2 Plugin
The Floating Notification Bar, Sticky Menu on Scroll, Announcement Banner, and Sticky Header for Any WordPress plugin before 2.7.3 does not validate and escape some of its settings before outputting them back in the page, which could allow users with a high role to perform Stored Cross-Site Scripting attacks.
PLUGIN
Before 2
CVE-2024-7133
Risk Score
Threat Entry
Updated 2024-09-27
CVE-2024-6850 - Before 2 Plugin
The Carousel Slider WordPress plugin before 2.2.4 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
PLUGIN
Before 2
CVE-2024-6850
Risk Score
Threat Entry
Updated 2024-09-27
CVE-2024-6723 - Before 2 Plugin
The AI Engine WordPress plugin before 2.4.8 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by admin users when viewing chatbot discussions.
PLUGIN
Before 2
CVE-2024-6723
Risk Score
Threat Entry
Updated 2025-05-16
CVE-2024-7891 - Before 2 Plugin
The Floating Contact Button WordPress plugin before 2.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
PLUGIN
Before 2
CVE-2024-7891
Risk Score
Threat Entry
Updated 2024-10-07
CVE-2024-6910 - Before 2 Plugin
The EventON WordPress plugin before 2.2.17 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed.
PLUGIN
Before 2
CVE-2024-6910
Risk Score
Threat Entry
Updated 2025-05-16
CVE-2024-6846 - Before 2 Plugin
The Chatbot with ChatGPT WordPress plugin before 2.4.5 does not validate access on some REST routes, allowing for an unauthenticated user to purge error and chat logs
PLUGIN
Before 2
CVE-2024-6846
Risk Score
Threat Entry
Updated 2024-10-07
CVE-2024-6020 - Before 2 Plugin
The Sign-up Sheets WordPress plugin before 2.2.13 does not escape some generated URLs, as well as the $_SERVER['REQUEST_URI'] parameter before outputting them back in attributes, which could lead to Reflected Cross-Site Scripting.
PLUGIN
Before 2
CVE-2024-6020
Risk Score
Threat Entry
Updated 2025-05-27
CVE-2024-6847 - Before 2 Plugin
The Chatbot with ChatGPT WordPress plugin before 2.4.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users when submitting messages to the chatbot.
PLUGIN
Before 2
CVE-2024-6847
Risk Score