Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2025-05-07
CVE-2024-10637 - Before 3 Plugin
The Gutenberg Blocks with AI by Kadence WP WordPress plugin before 3.2.54 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
PLUGIN
Before 3
CVE-2024-10637
Risk Score
Threat Entry
Updated 2025-05-15
CVE-2024-10471 - Before 3 Plugin
The Everest Forms WordPress plugin before 3.0.4.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
PLUGIN
Before 3
CVE-2024-10471
Risk Score
Threat Entry
Updated 2025-05-15
CVE-2024-6393 - Before 3 Plugin
The Photo Gallery, Sliders, Proofing and WordPress plugin before 3.59.5 does not sanitise and escape some of its Images settings, which could allow high privilege users such as Admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
PLUGIN
Before 3
CVE-2024-6393
Risk Score
Threat Entry
Updated 2025-06-09
CVE-2024-9422 - Before 3 Plugin
The GEO my WP WordPress plugin before 4.5, gmw-premium-settings WordPress plugin before 3.1 does not sufficiently validate files to be uploaded, which could allow attackers to upload arbitrary files such as PHP on the server.
PLUGIN
Before 3
CVE-2024-9422
Risk Score
Threat Entry
Updated 2026-01-09
CVE-2024-9828 - Before 3 Plugin
The Taskbuilder WordPress plugin before 3.0.5 does not sanitize user input into the 'load_orders' parameter and uses it in a SQL statement, allowing high privilege users such as admin to perform SQL Injection attacks
PLUGIN
Before 3
CVE-2024-9828
Risk Score
Threat Entry
Updated 2025-05-15
CVE-2024-9600 - Before 3 Plugin
The Ditty WordPress plugin before 3.1.47 does not sanitise and escape some of its settings, which could allow high privilege users such as author to perform Stored Cross-Site Scripting attacks.
PLUGIN
Before 3
CVE-2024-9600
Risk Score
Threat Entry
Updated 2025-05-15
CVE-2024-9186 - Before 3 Plugin
The Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit WordPress plugin before 3.3.0 does not sanitize and escape the bwfan-track-id parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks
PLUGIN
Before 3
CVE-2024-9186
Risk Score
Threat Entry
Updated 2025-05-15
CVE-2024-9836 - Before 3 Plugin
The RSS Feed Widget WordPress plugin before 3.0.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
PLUGIN
Before 3
CVE-2024-9836
Risk Score
Threat Entry
Updated 2025-05-15
CVE-2024-9835 - Before 3 Plugin
The RSS Feed Widget WordPress plugin before 3.0.1 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers
PLUGIN
Before 3
CVE-2024-9835
Risk Score
Threat Entry
Updated 2024-11-06
CVE-2024-9883 - Before 3 Plugin
The Pods WordPress plugin before 3.2.7.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
PLUGIN
Before 3
CVE-2024-9883
Risk Score
Threat Entry
Updated 2025-04-10
CVE-2024-8444 - Before 3 Plugin
The Download Manager WordPress plugin before 3.3.00 doesn't sanitize some of it's shortcode parameters, leading to cross site scripting.
PLUGIN
Before 3
CVE-2024-8444
Risk Score
Threat Entry
Updated 2024-10-15
CVE-2024-9796 - Before 3 Plugin
The WP-Advanced-Search WordPress plugin before 3.3.9.2 does not sanitize and escape the t parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks
PLUGIN
Before 3
CVE-2024-9796
Risk Score
Threat Entry
Updated 2024-10-07
CVE-2024-8379 - Before 3 Plugin
The Cost Calculator Builder WordPress plugin before 3.2.29 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as Admin.
PLUGIN
Before 3
CVE-2024-8379
Risk Score
Threat Entry
Updated 2024-10-03
CVE-2024-8536 - Before 3 Plugin
The Ultimate Blocks WordPress plugin before 3.2.2 does not validate and escape some of its block attributes before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
PLUGIN
Before 3
CVE-2024-8536
Risk Score
Threat Entry
Updated 2024-10-07
CVE-2024-8239 - Before 3 Plugin
The Starbox WordPress plugin before 3.5.3 does not properly render social media profiles URLs in certain contexts, like the malicious user's profile or pages where the starbox shortcode is used, which may be abused by users with at least the contributor role to conduct Stored XSS attacks.
PLUGIN
Before 3
CVE-2024-8239
Risk Score
Threat Entry
Updated 2024-09-26
CVE-2024-3163 - Before 3 Plugin
The Easy Property Listings WordPress plugin before 3.5.4 does not have CSRF check when deleting contacts in bulk, which could allow attackers to make a logged in admin delete them via a CSRF attack
PLUGIN
Before 3
CVE-2024-3163
Risk Score
Threat Entry
Updated 2024-09-25
CVE-2024-7716 - Before 3 Plugin
The Logo Slider WordPress plugin before 3.6.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
PLUGIN
Before 3
CVE-2024-7716
Risk Score
Threat Entry
Updated 2025-05-16
CVE-2024-7955 - Before 3 Plugin
The Starbox WordPress plugin before 3.5.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
PLUGIN
Before 3
CVE-2024-7955
Risk Score
Threat Entry
Updated 2024-10-04
CVE-2024-7354 - Before 3 Plugin
The Ninja Forms WordPress plugin before 3.8.11 does not escape an URL before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
PLUGIN
Before 3
CVE-2024-7354
Risk Score
Threat Entry
Updated 2024-10-07
CVE-2024-7132 - Before 3 Plugin
The Page Builder Gutenberg Blocks WordPress plugin before 3.1.13 does not escape the content of post embed via one of its block, which could allow users with the capability to publish posts (editor and admin by default) to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
PLUGIN
Before 3
CVE-2024-7132
Risk Score