Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-08-03
CVE-2026-16057 - Before 30 Plugin
The Contest Gallery WordPress plugin before 30.0.7 does not perform per-object capability or nonce checks in one of its post-deletion handlers, gating it only by a coarse role-membership test, which allows any Author-level or higher user to permanently delete arbitrary posts, pages, and other content they do not own.
PLUGIN
Before 30
CVE-2026-16057
Risk Score
Threat Entry
Updated 2025-05-29
CVE-2024-3983 - Before 30 Plugin
The WooCommerce Customers Manager WordPress plugin before 30.1 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting customers via CSRF attacks
PLUGIN
Before 30
CVE-2024-3983
Risk Score
Threat Entry
Updated 2025-05-29
CVE-2024-2843 - Before 30 Plugin
The WooCommerce Customers Manager WordPress plugin before 30.1 does not have CSRF checks in some places, which could allow attackers to make logged in admin users delete users via CSRF attacks
PLUGIN
Before 30
CVE-2024-2843
Risk Score
Threat Entry
Updated 2025-05-29
CVE-2024-1747 - Before 30 Plugin
The WooCommerce Customers Manager WordPress plugin before 30.2 does not have authorisation and CSRF in various AJAX actions, allowing any authenticated users, such as subscriber, to call them and update/delete/create customer metadata, also leading to Stored Cross-Site Scripting due to the lack of escaping of said metadata values.
PLUGIN
Before 30
CVE-2024-1747
Risk Score