Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2025-12-19
CVE-2025-11560 - Before 3 Plugin
The Team Members Showcase WordPress plugin before 3.5.0 does not sanitize and escape a parameter before outputting it back in the page, leading to reflected cross-site scripting, which could be used against high-privilege users such as admins.
PLUGIN
Before 3
CVE-2025-11560
Risk Score
Threat Entry
Updated 2025-11-06
CVE-2025-10567 - Before 3 Plugin
The FunnelKit WordPress plugin before 3.12.0.1 does not sanitize user input before echoing it back in some of its checkout-related AJAX actions, allowing attackers to conduct reflected XSS attacks against logged-in users.
PLUGIN
Before 3
CVE-2025-10567
Risk Score
Threat Entry
Updated 2026-01-09
CVE-2025-10874 - Before 3 Plugin
The Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More WordPress plugin before 3.0.2 does not limit URLs which may be used for the stock photo import feature, allowing the user to specify arbitrary URLs. This leads to a server-side request forgery as the user may force the server to access any URL of their choosing.
PLUGIN
Before 3
CVE-2025-10874
Risk Score
Threat Entry
Updated 2025-10-22
CVE-2025-5983 - Before 3 Plugin
The Meta Tag Manager WordPress plugin before 3.3 does not restrict which roles can create http-equiv refresh meta tags.
PLUGIN
Before 3
CVE-2025-5983
Risk Score
Threat Entry
Updated 2026-01-09
CVE-2025-10406 - Before 3 Plugin
The BlindMatrix e-Commerce WordPress plugin before 3.1 does not validate some shortcode attributes before using them to generate paths passed to include function/s, allowing any authenticated users, such as contributors, to perform LFI attacks.
PLUGIN
Before 3
CVE-2025-10406
Risk Score
Threat Entry
Updated 2025-09-22
CVE-2025-9115 - Before 3 Plugin
The Etsy Shop WordPress plugin before 3.0.7 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers.
PLUGIN
Before 3
CVE-2025-9115
Risk Score
Threat Entry
Updated 2025-09-22
CVE-2025-9541 - Before 3 Plugin
The Markup Markdown WordPress plugin before 3.20.10 allows links to contain JavaScript which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
PLUGIN
Before 3
CVE-2025-9541
Risk Score
Threat Entry
Updated 2025-09-22
CVE-2025-9540 - Before 3 Plugin
The Markup Markdown WordPress plugin before 3.20.10 allows links to contain JavaScript which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
PLUGIN
Before 3
CVE-2025-9540
Risk Score
Threat Entry
Updated 2025-12-23
CVE-2025-9083 - Before 3 Plugin
The Ninja Forms WordPress plugin before 3.11.1 unserializes user input via form field, which could allow Unauthenticated users to perform PHP Object Injection when a suitable gadget is present on the blog.
PLUGIN
Before 3
CVE-2025-9083
Risk Score
Threat Entry
Updated 2026-02-09
CVE-2025-8085 - Before 3 Plugin
The Ditty WordPress plugin before 3.1.58 lacks authorization and authentication for requests to its displayItems endpoint, allowing unauthenticated visitors to make requests to arbitrary URLs.
PLUGIN
Before 3
CVE-2025-8085
Risk Score
Threat Entry
Updated 2025-07-01
CVE-2025-3745 - Before 3 Plugin
The WP Lightbox 2 WordPress plugin before 3.0.6.8 does not correctly sanitize the value of the title attribute of links before using them, which may allow malicious users to conduct XSS attacks.
PLUGIN
Before 3
CVE-2025-3745
Risk Score
Threat Entry
Updated 2025-06-05
CVE-2025-3662 - Before 3 Plugin
The FancyBox for WordPress plugin before 3.3.6 does not escape captions and titles attributes before using them to populate galleries' caption fields. The issue was received as a Contributor+ Stored XSS, however one of our researcher (Marc Montpas) escalated it to an Unauthenticated Stored XSS
PLUGIN
Before 3
CVE-2025-3662
Risk Score
Threat Entry
Updated 2025-08-01
CVE-2025-4567 - Before 3 Plugin
The Post Slider and Post Carousel with Post Vertical Scrolling Widget WordPress plugin before 3.2.10 does not validate and escape some of its Widget options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
PLUGIN
Before 3
CVE-2025-4567
Risk Score
Threat Entry
Updated 2026-01-09
CVE-2025-2561 - Before 3 Plugin
The Ninja Forms WordPress plugin before 3.10.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
PLUGIN
Before 3
CVE-2025-2561
Risk Score
Threat Entry
Updated 2026-01-09
CVE-2025-2560 - Before 3 Plugin
The Ninja Forms WordPress plugin before 3.10.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
PLUGIN
Before 3
CVE-2025-2560
Risk Score
Threat Entry
Updated 2026-01-09
CVE-2025-2524 - Before 3 Plugin
The Ninja Forms WordPress plugin before 3.10.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
PLUGIN
Before 3
CVE-2025-2524
Risk Score
Threat Entry
Updated 2025-06-12
CVE-2025-2203 - Before 3 Plugin
The FunnelKit WordPress plugin before 3.10.2 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks
PLUGIN
Before 3
CVE-2025-2203
Risk Score
Threat Entry
Updated 2025-06-12
CVE-2024-9831 - Before 3 Plugin
The Taskbuilder WordPress plugin before 3.0.9 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks
PLUGIN
Before 3
CVE-2024-9831
Risk Score
Threat Entry
Updated 2025-06-04
CVE-2024-9233 - Before 3 Plugin
The Logo Slider WordPress plugin before 3.7.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
PLUGIN
Before 3
CVE-2024-9233
Risk Score
Threat Entry
Updated 2025-06-12
CVE-2024-8759 - Before 3 Plugin
The Nested Pages WordPress plugin before 3.2.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
PLUGIN
Before 3
CVE-2024-8759
Risk Score