Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2025-04-29
CVE-2024-13610 - Before 6 Plugin
The Simple Social Media Share Buttons WordPress plugin before 6.0.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
PLUGIN
Before 6
CVE-2024-13610
Risk Score
Threat Entry
Updated 2025-04-29
CVE-2024-13207 - Before 6 Plugin
The Widget for Social Page Feeds WordPress plugin before 6.4.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
PLUGIN
Before 6
CVE-2024-13207
Risk Score
Threat Entry
Updated 2025-05-21
CVE-2024-11638 - Before 6 Plugin
The Gtbabel WordPress plugin before 6.6.9 does not ensure that the URL to perform code analysis upon belongs to the blog which could allow unauthenticated attackers to retrieve a logged in user (such as admin) cookies by making them open a crafted URL as the request made to analysed the URL contains such cookies.
PLUGIN
Before 6
CVE-2024-11638
Risk Score
Threat Entry
Updated 2025-05-15
CVE-2024-10483 - Before 6 Plugin
The Simple:Press Forum WordPress plugin before 6.10.11 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting.
PLUGIN
Before 6
CVE-2024-10483
Risk Score
Threat Entry
Updated 2025-05-14
CVE-2024-5333 - Before 6 Plugin
The Events Calendar WordPress plugin before 6.8.2.1 is missing access checks in the REST API, allowing for unauthenticated users to access information about password protected events.
PLUGIN
Before 6
CVE-2024-5333
Risk Score
Threat Entry
Updated 2024-11-26
CVE-2024-9768 - Before 6 Plugin
The Formidable Forms WordPress plugin before 6.14.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
PLUGIN
Before 6
CVE-2024-9768
Risk Score
Threat Entry
Updated 2025-06-11
CVE-2024-9529 - Before 6 Plugin
The Secure Custom Fields WordPress plugin before 6.3.9, Secure Custom Fields WordPress plugin before 6.3.6.3, Advanced Custom Fields Pro WordPress plugin before 6.3.9 does not prevent users from running arbitrary functions through its setting import functionalities, which could allow high privilege users such as admin to run arbitrary PHP functions.
PLUGIN
Before 6
CVE-2024-9529
Risk Score
Threat Entry
Updated 2025-05-15
CVE-2024-10146 - Before 6 Plugin
The Simple File List WordPress plugin before 6.1.13 does not sanitise and escape a generated URL before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against admins.
PLUGIN
Before 6
CVE-2024-10146
Risk Score
Threat Entry
Updated 2025-07-07
CVE-2024-5285 - Before 6 Plugin
The wp-affiliate-platform WordPress plugin before 6.5.2 does not have CSRF check in place when deleting affiliates, which could allow attackers to make a logged in user change delete them via a CSRF attack
PLUGIN
Before 6
CVE-2024-5285
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-6205 - Before 6 Plugin
The PayPlus Payment Gateway WordPress plugin before 6.6.9 does not properly sanitise and escape a parameter before using it in a SQL statement via a WooCommerce API route available to unauthenticated users, leading to an SQL injection vulnerability.
PLUGIN
Before 6
CVE-2024-6205
Risk Score
Threat Entry
Updated 2025-05-19
CVE-2024-5287 - Before 6 Plugin
The wp-affiliate-platform WordPress plugin before 6.5.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in user change them via a CSRF attack
PLUGIN
Before 6
CVE-2024-5287
Risk Score
Threat Entry
Updated 2025-05-19
CVE-2024-5284 - Before 6 Plugin
The wp-affiliate-platform WordPress plugin before 6.5.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack
PLUGIN
Before 6
CVE-2024-5284
Risk Score
Threat Entry
Updated 2025-05-19
CVE-2024-5283 - Before 6 Plugin
The wp-affiliate-platform WordPress plugin before 6.5.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
PLUGIN
Before 6
CVE-2024-5283
Risk Score
Threat Entry
Updated 2025-05-19
CVE-2024-5282 - Before 6 Plugin
The wp-affiliate-platform WordPress plugin before 6.5.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
PLUGIN
Before 6
CVE-2024-5282
Risk Score
Threat Entry
Updated 2025-05-19
CVE-2024-5281 - Before 6 Plugin
The wp-affiliate-platform WordPress plugin before 6.5.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
PLUGIN
Before 6
CVE-2024-5281
Risk Score
Threat Entry
Updated 2025-05-19
CVE-2024-5286 - Before 6 Plugin
The wp-affiliate-platform WordPress plugin before 6.5.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
PLUGIN
Before 6
CVE-2024-5286
Risk Score
Threat Entry
Updated 2025-05-19
CVE-2024-5280 - Before 6 Plugin
The wp-affiliate-platform WordPress plugin before 6.5.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make non-logged in users execute an XSS payload via a CSRF attack
PLUGIN
Before 6
CVE-2024-5280
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-2376 - Before 6 Plugin
The WPQA Builder WordPress plugin before 6.1.1 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks
PLUGIN
Before 6
CVE-2024-2376
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-2375 - Before 6 Plugin
The WPQA Builder WordPress plugin before 6.1.1 does not sanitise and escape some of its Slider settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks
PLUGIN
Before 6
CVE-2024-2375
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-4565 - Before 6 Plugin
The Advanced Custom Fields (ACF) WordPress plugin before 6.3, Advanced Custom Fields Pro WordPress plugin before 6.3 allows you to display custom field values for any post via shortcode without checking for the correct access
PLUGIN
Before 6
CVE-2024-4565
Risk Score