Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2024-11-21
CVE-2024-2235 - Before 2 Theme
The Himer WordPress theme before 2.1.1 does not have CSRF checks in some places, which could allow attackers to make users vote on any polls, including those they don't have access to via a CSRF attack
THEME
Before 2
CVE-2024-2235
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-2233 - Before 2 Theme
The Himer WordPress theme before 2.1.1 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks. These include declining and accepting group invitations or leaving a group
THEME
Before 2
CVE-2024-2233
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-2040 - Before 2 Theme
The Himer WordPress theme before 2.1.1 does not have CSRF checks in some places, which could allow attackers to make users join private groups via a CSRF attack
THEME
Before 2
CVE-2024-2040
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-3999 - Before 2 Plugin
The EazyDocs WordPress plugin before 2.5.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
PLUGIN
Before 2
CVE-2024-3999
Risk Score
Threat Entry
Updated 2025-03-13
CVE-2024-1330 - Before 2 Plugin
The kadence-blocks-pro WordPress plugin before 2.3.8 does not prevent users with at least the contributor role using some of its shortcode's functionalities to leak arbitrary options from the database.
PLUGIN
Before 2
CVE-2024-1330
Risk Score
Threat Entry
Updated 2025-05-19
CVE-2024-5573 - Before 2 Plugin
The Easy Table of Contents WordPress plugin before 2.0.66 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
PLUGIN
Before 2
CVE-2024-5573
Risk Score
Threat Entry
Updated 2025-05-19
CVE-2024-5522 - Before 2 Plugin
The HTML5 Video Player WordPress plugin before 2.5.27 does not sanitize and escape a parameter from a REST route before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks
PLUGIN
Before 2
CVE-2024-5522
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-3276 - Before 2 Plugin
The Lightbox & Modal Popup WordPress Plugin WordPress plugin before 2.7.28, foobox-image-lightbox-premium WordPress plugin before 2.7.28 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
PLUGIN
Before 2
CVE-2024-3276
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-2762 - Before 2 Plugin
The FooGallery WordPress plugin before 2.4.15, foogallery-premium WordPress plugin before 2.4.15 does not validate and escape some of its Gallery settings before outputting them back in the page, which could allow users with a role as low as Author to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin
PLUGIN
Before 2
CVE-2024-2762
Risk Score
Threat Entry
Updated 2025-06-30
CVE-2024-4750 - Before 2 Plugin
The buddyboss-platform WordPress plugin before 2.6.0 contains an IDOR vulnerability that allows a user to like a private post by manipulating the ID included in the request
PLUGIN
Before 2
CVE-2024-4750
Risk Score
Threat Entry
Updated 2025-04-10
CVE-2024-4372 - Before 2 Plugin
The Carousel Slider WordPress plugin before 2.2.11 does not sanitise and escape some parameters, which could allow users with a role as low as editor to perform Cross-Site Scripting attacks
PLUGIN
Before 2
CVE-2024-4372
Risk Score
Threat Entry
Updated 2025-06-30
CVE-2024-3634 - Before 2 Plugin
The month name translation benaceur WordPress plugin before 2.3.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
PLUGIN
Before 2
CVE-2024-3634
Risk Score
Threat Entry
Updated 2025-04-10
CVE-2024-3703 - Before 2 Plugin
The Carousel Slider WordPress plugin before 2.2.10 does not validate and escape some of its Slide options before outputting them back in the page/post where the related Slide shortcode is embed, which could allow users with the Editor role and above to perform Stored Cross-Site Scripting attacks
PLUGIN
Before 2
CVE-2024-3703
Risk Score
Threat Entry
Updated 2025-05-08
CVE-2024-3477 - Before 2 Plugin
The Popup Box WordPress plugin before 2.2.7 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting popups via CSRF attacks
PLUGIN
Before 2
CVE-2024-3477
Risk Score
Threat Entry
Updated 2025-04-08
CVE-2024-1905 - Before 2 Plugin
The Smart Forms WordPress plugin before 2.6.96 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
PLUGIN
Before 2
CVE-2024-1905
Risk Score
Threat Entry
Updated 2025-05-08
CVE-2023-7253 - Before 2 Plugin
The Import WP WordPress plugin before 2.13.1 does not prevent users with the administrator role from pinging conducting SSRF attacks, which may be a problem in multisite configurations.
PLUGIN
Before 2
CVE-2023-7253
Risk Score
Threat Entry
Updated 2025-05-08
CVE-2024-2729 - Before 2 Plugin
The Otter Blocks WordPress plugin before 2.6.6 does not properly escape its mainHeadings blocks' attribute before appending it to the final rendered block, allowing contributors to conduct Stored XSS attacks.
PLUGIN
Before 2
CVE-2024-2729
Risk Score
Threat Entry
Updated 2025-05-08
CVE-2024-2118 - Before 2 Plugin
The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 2.8.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
PLUGIN
Before 2
CVE-2024-2118
Risk Score
Threat Entry
Updated 2025-06-17
CVE-2024-0868 - Before 2 Plugin
The coreActivity: Activity Logging plugin for WordPress plugin before 2.1 retrieved IP addresses of requests via headers such X-FORWARDED to log them, allowing users to spoof them by providing an arbitrary value
PLUGIN
Before 2
CVE-2024-0868
Risk Score
Threat Entry
Updated 2025-04-08
CVE-2024-1307 - Before 2 Plugin
The Smart Forms WordPress plugin before 2.6.94 does not have proper authorization in some actions, which could allow users with a role as low as a subscriber to call them and perform unauthorized actions
PLUGIN
Before 2
CVE-2024-1307
Risk Score