Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2024-11-21
CVE-2023-6077 - Before 3 Plugin
The Slider WordPress plugin before 3.5.12 does not ensure that posts to be accessed via an AJAX action are slides and can be viewed by the user making the request, allowing any authenticated users, such as subscriber to access the content arbitrary post such as private, draft and password protected
PLUGIN
Before 3
CVE-2023-6077
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-6065 - Before 3 Plugin
The Quttera Web Malware Scanner WordPress plugin before 3.4.2.1 doesn't restrict access to detailed scan logs, which allows a malicious actor to discover local paths and portions of the site's code
PLUGIN
Before 3
CVE-2023-6065
Risk Score
Threat Entry
Updated 2025-05-07
CVE-2023-5005 - Before 3 Plugin
The Autocomplete Location field Contact Form 7 WordPress plugin before 3.0, autocomplete-location-field-contact-form-7-pro WordPress plugin before 2.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
PLUGIN
Before 3
CVE-2023-5005
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-5750 - Before 3 Plugin
The EmbedPress WordPress plugin before 3.9.2 does not sanitise and escape a parameter before outputting it back in the page containing a specific content, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
PLUGIN
Before 3
CVE-2023-5750
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-5749 - Before 3 Plugin
The EmbedPress WordPress plugin before 3.9.2 does not sanitise and escape user input before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
PLUGIN
Before 3
CVE-2023-5749
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-5990 - Before 3 Plugin
The Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor WordPress plugin before 3.4.2 does not have CSRF checks on some of its form actions such as deletion and duplication, which could allow attackers to make logged in admin perform such actions via CSRF attacks
PLUGIN
Before 3
CVE-2023-5990
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-5979 - Before 3 Plugin
The eCommerce Product Catalog Plugin for WordPress plugin before 3.3.26 does not have CSRF checks in some of its admin pages, which could allow attackers to make logged-in users perform unwanted actions via CSRF attacks, such as delete all products
PLUGIN
Before 3
CVE-2023-5979
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-5874 - Before 3 Plugin
The Popup box WordPress plugin before 3.8.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
PLUGIN
Before 3
CVE-2023-5874
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-5809 - Before 3 Plugin
The Popup box WordPress plugin before 3.8.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
PLUGIN
Before 3
CVE-2023-5809
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-4799 - Before 3 Plugin
The Magic Embeds WordPress plugin before 3.1.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
PLUGIN
Before 3
CVE-2023-4799
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-5343 - Before 3 Plugin
The Popup box WordPress plugin before 3.7.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed.
PLUGIN
Before 3
CVE-2023-5343
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-5530 - Before 3 Plugin
The Ninja Forms Contact Form WordPress plugin before 3.6.34 does not sanitize and escape its label fields, which could allow high privilege users such as admin to perform Stored XSS attacks. Only users with the unfiltered_html capability can perform this, and such users are already allowed to use JS in posts/comments etc however the vendor acknowledged and fixed the issue
PLUGIN
Before 3
CVE-2023-5530
Risk Score
Threat Entry
Updated 2025-02-26
CVE-2023-5228 - Before 3 Plugin
The User Registration WordPress plugin before 3.0.4.2 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
PLUGIN
Before 3
CVE-2023-5228
Risk Score
Threat Entry
Updated 2025-04-22
CVE-2023-5238 - Before 3 Plugin
The EventPrime WordPress plugin before 3.2.0 does not sanitise and escape a parameter before outputting it back in the page, leading to an HTML Injection on the plugin in the search area of the website.
PLUGIN
Before 3
CVE-2023-5238
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-5458 - Before 3 Plugin
The CITS Support svg, webp Media and TTF,OTF File Upload WordPress plugin before 3.0 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads.
PLUGIN
Before 3
CVE-2023-5458
Risk Score
Threat Entry
Updated 2025-04-23
CVE-2023-5519 - Before 3 Plugin
The EventPrime WordPress plugin before 3.2.0 does not have CSRF checks when creating bookings, which could allow attackers to make logged in users create unwanted bookings via CSRF attacks.
PLUGIN
Before 3
CVE-2023-5519
Risk Score
Threat Entry
Updated 2025-04-03
CVE-2023-4250 - Before 3 Plugin
The EventPrime WordPress plugin before 3.2.0 does not sanitise and escape some parameters before outputting them back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
PLUGIN
Before 3
CVE-2023-4250
Risk Score
Threat Entry
Updated 2025-04-23
CVE-2023-4390 - Before 3 Plugin
The Popup box WordPress plugin before 3.7.2 does not sanitize and escape some Popup fields, which could allow high-privilege users such as an administrator to inject arbitrary web scripts even when the unfiltered_html capability is disallowed (for example in a multisite setup).
PLUGIN
Before 3
CVE-2023-4390
Risk Score
Threat Entry
Updated 2025-04-22
CVE-2023-4251 - Before 3 Plugin
The EventPrime WordPress plugin before 3.2.0 does not have CSRF checks when creating bookings, which could allow attackers to make logged in users create unwanted bookings via CSRF attacks.
PLUGIN
Before 3
CVE-2023-4251
Risk Score
Threat Entry
Updated 2025-04-23
CVE-2023-4950 - Before 3 Plugin
The Interactive Contact Form and Multi Step Form Builder WordPress plugin before 3.4 does not sanitise and escape some parameters, which could allow unauthenticated users to perform Cross-Site Scripting attacks
PLUGIN
Before 3
CVE-2023-4950
Risk Score