Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2025-04-23
CVE-2023-4022 - Before 5 Plugin
The Herd Effects WordPress plugin before 5.2.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
PLUGIN
Before 5
CVE-2023-4022
Risk Score
Threat Entry
Updated 2025-03-06
CVE-2023-3814 - Before 5 Plugin
The Advanced File Manager WordPress plugin before 5.1.1 does not adequately authorize its usage on multisite installations, allowing site admin users to list and read arbitrary files and folders on the server.
PLUGIN
Before 5
CVE-2023-3814
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-0579 - Before 5 Plugin
The YARPP WordPress plugin before 5.30.3 does not validate and escape some of its shortcode attributes before using them in SQL statement/s, which could allow any authenticated users, such as subscribers to perform SQL Injection attacks.
PLUGIN
Before 5
CVE-2023-0579
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-3225 - Before 5 Plugin
The Float menu WordPress plugin before 5.0.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
PLUGIN
Before 5
CVE-2023-3225
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-2320 - Before 5 Plugin
The CF7 Google Sheets Connector WordPress plugin before 5.0.2, cf7-google-sheets-connector-pro WordPress plugin through 5.0.2 does not escape a parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
PLUGIN
Before 5
CVE-2023-2320
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-2711 - Before 5 Plugin
The Ultimate Product Catalog WordPress plugin before 5.2.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
PLUGIN
Before 5
CVE-2023-2711
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-2568 - Before 5 Plugin
The Photo Gallery by Ays WordPress plugin before 5.1.7 does not escape some parameters before outputting it back in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin
PLUGIN
Before 5
CVE-2023-2568
Risk Score
Threat Entry
Updated 2025-05-05
CVE-2023-2362 - Before 5 Plugin
The Float menu WordPress plugin before 5.0.2, Bubble Menu WordPress plugin before 3.0.4, Button Generator WordPress plugin before 2.3.5, Calculator Builder WordPress plugin before 1.5.1, Counter Box WordPress plugin before 1.2.2, Floating Button WordPress plugin before 5.3.1, Herd Effects WordPress plugin before 5.2.2, Popup Box WordPress plugin before 2.2.2, Side Menu Lite WordPress plugin before 4.0.2, Sticky Buttons WordPress plugin before 3.1.1, Wow Skype Buttons WordPress plugin before 4.0.2, WP Coder WordPress plugin before 2.5.6 do not escape the page parameter before outputting it back in an attribute, leading to…
PLUGIN
Before 5
CVE-2023-2362
Risk Score
Threat Entry
Updated 2025-01-30
CVE-2023-1554 - Before 5 Plugin
The Quick Paypal Payments WordPress plugin before 5.7.26.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
PLUGIN
Before 5
CVE-2023-1554
Risk Score
Threat Entry
Updated 2025-02-06
CVE-2023-1282 - Before 5 Plugin
The Drag and Drop Multiple File Upload PRO - Contact Form 7 Standard WordPress plugin before 2.11.1 and Drag and Drop Multiple File Upload PRO - Contact Form 7 with Remote Storage Integrations WordPress plugin before 5.0.6.4 do not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high-privilege users such as admins.
PLUGIN
Before 5
CVE-2023-1282
Risk Score
Threat Entry
Updated 2025-02-11
CVE-2023-0156 - Before 5 Plugin
The All-In-One Security (AIOS) WordPress plugin before 5.1.5 does not limit what log files to display in it's settings pages, allowing an authorized user (admin+) to view the contents of arbitrary files and list directories anywhere on the server (to which the web server has access). The plugin only displays the last 50 lines of the file.
PLUGIN
Before 5
CVE-2023-0156
Risk Score
Threat Entry
Updated 2025-02-11
CVE-2023-0157 - Before 5 Plugin
The All-In-One Security (AIOS) WordPress plugin before 5.1.5 does not escape the content of log files before outputting it to the plugin admin page, allowing an authorized user (admin+) to plant bogus log files containing malicious JavaScript code that will be executed in the context of any administrator visiting this page.
PLUGIN
Before 5
CVE-2023-0157
Risk Score
Threat Entry
Updated 2025-02-14
CVE-2023-1124 - Before 5 Plugin
The Shopping Cart & eCommerce Store WordPress plugin before 5.4.3 does not validate HTTP requests, allowing authenticated users with admin privileges to perform LFI attacks.
PLUGIN
Before 5
CVE-2023-1124
Risk Score
Threat Entry
Updated 2025-02-26
CVE-2023-0940 - Before 5 Plugin
The ProfileGrid WordPress plugin before 5.3.1 provides an AJAX endpoint for resetting a user password but does not implement proper authorization. This allows a user with low privileges, such as subscriber, to change the password of any account, including Administrator ones.
PLUGIN
Before 5
CVE-2023-0940
Risk Score
Threat Entry
Updated 2025-02-25
CVE-2023-0911 - Before 5 Plugin
The WordPress Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 5.12.8 does not validate the user meta to be retrieved via the user shortcode, allowing any authenticated users such as subscriber to retrieve arbitrary user meta (except the user_pass), such as the user email and activation key by default.
PLUGIN
Before 5
CVE-2023-0911
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-0890 - Before 5 Plugin
The WordPress Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 5.12.8 does not ensure that posts to be displayed via some shortcodes are already public and can be accessed by the user making the request, allowing any authenticated users such as subscriber to view draft, private or even password protected posts. It is also possible to leak the password of protected posts
PLUGIN
Before 5
CVE-2023-0890
Risk Score
Threat Entry
Updated 2025-02-26
CVE-2023-0364 - Before 5 Plugin
The real.Kit WordPress plugin before 5.1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
PLUGIN
Before 5
CVE-2023-0364
Risk Score
Threat Entry
Updated 2025-06-10
CVE-2023-0378 - Before 5 Plugin
The Greenshift WordPress plugin before 5.0 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
PLUGIN
Before 5
CVE-2023-0378
Risk Score
Threat Entry
Updated 2025-03-21
CVE-2023-0080 - Before 5 Plugin
The Customer Reviews for WooCommerce WordPress plugin before 5.16.0 does not validate one of its shortcode attribute, which could allow users with a contributor role and above to include arbitrary files via a traversal attack. This could also allow them to read non PHP files and retrieve their content. RCE could also be achieved if the attacker manage to upload a malicious image containing PHP code, and then include it via the affected attribute, on a default WP install, authors could easily achieve that given that they have the upload_file…
PLUGIN
Before 5
CVE-2023-0080
Risk Score
Threat Entry
Updated 2025-05-09
CVE-2022-3302 - Before 5 Plugin
The Spam protection, AntiSpam, FireWall by CleanTalk WordPress plugin before 5.185.1 does not validate ids before using them in a SQL statement, which could lead to SQL injection exploitable by high privilege users such as admin
PLUGIN
Before 5
CVE-2022-3302
Risk Score