Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2024-11-21
CVE-2023-4933 - Before 3 Plugin
The WP Job Openings WordPress plugin before 3.4.3 does not block listing the contents of the directories where it stores attachments to job applications, allowing unauthenticated visitors to list and download private attachments if the autoindex feature of the web server is enabled.
PLUGIN
Before 3
CVE-2023-4933
Risk Score
Threat Entry
Updated 2025-03-06
CVE-2023-4800 - Before 3 Plugin
The DoLogin Security WordPress plugin before 3.7.1 does not restrict the access of a widget that shows the IPs of failed logins to low privileged users.
PLUGIN
Before 3
CVE-2023-4800
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-3154 - Before 3 Plugin
The WordPress Gallery Plugin WordPress plugin before 3.39 is vulnerable to PHAR Deserialization due to a lack of input parameter validation in the `gallery_edit` function, allowing an attacker to access arbitrary resources on the server.
PLUGIN
Before 3
CVE-2023-3154
Risk Score
Threat Entry
Updated 2025-04-23
CVE-2023-3155 - Before 3 Plugin
The WordPress Gallery Plugin WordPress plugin before 3.39 is vulnerable to Arbitrary File Read and Delete due to a lack of input parameter validation in the `gallery_edit` function, allowing an attacker to access arbitrary resources on the server.
PLUGIN
Before 3
CVE-2023-3155
Risk Score
Threat Entry
Updated 2025-04-23
CVE-2023-3279 - Before 3 Plugin
The WordPress Gallery Plugin WordPress plugin before 3.39 does not validate some block attributes before using them to generate paths passed to include function/s, allowing Admin users to perform LFI attacks
PLUGIN
Before 3
CVE-2023-3279
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-3392 - Before 3 Plugin
The Read More & Accordion WordPress plugin before 3.2.7 unserializes user input provided via the settings, which could allow high-privilege users such as admin to perform PHP Object Injection when a suitable gadget is present.
PLUGIN
Before 3
CVE-2023-3392
Risk Score
Threat Entry
Updated 2026-03-03
CVE-2023-4549 - Before 3 Plugin
The DoLogin Security WordPress plugin before 3.7 does not properly sanitize IP addresses coming from the X-Forwarded-For header, which can be used by attackers to conduct Stored XSS attacks via WordPress' login form.
PLUGIN
Before 3
CVE-2023-4549
Risk Score
Threat Entry
Updated 2025-04-23
CVE-2023-4476 - Before 3 Plugin
The Locatoraid Store Locator WordPress plugin before 3.9.24 does not sanitise and escape the lpr-search parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
PLUGIN
Before 3
CVE-2023-4476
Risk Score
Threat Entry
Updated 2026-03-03
CVE-2023-4631 - Before 3 Plugin
The DoLogin Security WordPress plugin before 3.7 uses headers such as the X-Forwarded-For to retrieve the IP address of the request, which could lead to IP spoofing.
PLUGIN
Before 3
CVE-2023-4631
Risk Score
Threat Entry
Updated 2025-05-02
CVE-2023-4502 - Before 3 Plugin
The Translate WordPress with GTranslate WordPress plugin before 3.0.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). This vulnerability affects multiple parameters.
PLUGIN
Before 3
CVE-2023-4502
Risk Score
Threat Entry
Updated 2025-05-01
CVE-2023-4148 - Before 3 Plugin
The Ditty WordPress plugin before 3.1.25 does not sanitise and escape some parameters and generated URLs before outputting them back in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
PLUGIN
Before 3
CVE-2023-4148
Risk Score
Threat Entry
Updated 2025-04-23
CVE-2023-2995 - Before 3 Plugin
The Leyka WordPress plugin before 3.30.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
PLUGIN
Before 3
CVE-2023-2995
Risk Score
Threat Entry
Updated 2025-04-23
CVE-2023-4060 - Before 3 Plugin
The WP Adminify WordPress plugin before 3.1.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
PLUGIN
Before 3
CVE-2023-4060
Risk Score
Threat Entry
Updated 2025-03-06
CVE-2023-4059 - Before 3 Plugin
The Profile Builder WordPress plugin before 3.9.8 lacks authorisation and CSRF in its page creation function which allows unauthenticated users to create the register, log-in and edit-profile pages from the plugin on the blog
PLUGIN
Before 3
CVE-2023-4059
Risk Score
Threat Entry
Updated 2025-04-23
CVE-2023-3499 - Before 3 Plugin
The Photo Gallery, Images, Slider in Rbs Image Gallery WordPress plugin before 3.2.16 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
PLUGIN
Before 3
CVE-2023-3499
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-2813 - Before 3 Theme
All of the above Aapna WordPress theme through 1.3, Anand WordPress theme through 1.2, Anfaust WordPress theme through 1.1, Arendelle WordPress theme before 1.1.13, Atlast Business WordPress theme through 1.5.8.5, Bazaar Lite WordPress theme before 1.8.6, Brain Power WordPress theme through 1.2, BunnyPressLite WordPress theme before 2.1, Cafe Bistro WordPress theme before 1.1.4, College WordPress theme before 1.5.1, Connections Reloaded WordPress theme through 3.1, Counterpoint WordPress theme through 1.8.1, Digitally WordPress theme through 1.0.8, Directory WordPress theme before 3.0.2, Drop WordPress theme before 1.22, Everse WordPress theme before 1.2.4, Fashionable…
THEME
Before 3
CVE-2023-2813
Risk Score
Threat Entry
Updated 2025-04-23
CVE-2023-3992 - Before 3 Plugin
The PostX WordPress plugin before 3.0.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
PLUGIN
Before 3
CVE-2023-3992
Risk Score
Threat Entry
Updated 2025-04-23
CVE-2023-4109 - Before 3 Plugin
The Ninja Forms WordPress Ninja Forms Contact Form WordPress plugin before 3.6.26 was affected by a HTML Injection security vulnerability.
PLUGIN
Before 3
CVE-2023-4109
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-2803 - Before 3 Plugin
The Ultimate Addons for Contact Form 7 WordPress plugin before 3.1.29 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
PLUGIN
Before 3
CVE-2023-2803
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-2802 - Before 3 Plugin
The Ultimate Addons for Contact Form 7 WordPress plugin before 3.1.29 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
PLUGIN
Before 3
CVE-2023-2802
Risk Score