Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2025-05-19
CVE-2024-4899 - Before 7 Plugin
The SEOPress WordPress plugin before 7.8 does not sanitise and escape some of its Post settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks.
PLUGIN
Before 7
CVE-2024-4899
Risk Score
Threat Entry
Updated 2025-03-17
CVE-2024-3032 - Before 7 Plugin
Themify Builder WordPress plugin before 7.5.8 does not validate a parameter before redirecting the user to its value, leading to an Open Redirect issue
PLUGIN
Before 7
CVE-2024-3032
Risk Score
Threat Entry
Updated 2025-05-21
CVE-2024-3050 - Before 7 Plugin
The Site Reviews WordPress plugin before 7.0.0 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate its value. This may be used to bypass IP-based blocking
PLUGIN
Before 7
CVE-2024-3050
Risk Score
Threat Entry
Updated 2025-03-27
CVE-2024-3548 - Before 7 Plugin
The WP Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 7.1.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
PLUGIN
Before 7
CVE-2024-3548
Risk Score
Threat Entry
Updated 2025-05-14
CVE-2024-3188 - Before 7 Plugin
The WP Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 7.1.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
PLUGIN
Before 7
CVE-2024-3188
Risk Score
Threat Entry
Updated 2025-05-14
CVE-2024-2907 - Before 7 Plugin
The AGCA WordPress plugin before 7.2.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
PLUGIN
Before 7
CVE-2024-2907
Risk Score
Threat Entry
Updated 2025-05-08
CVE-2024-2836 - Before 7 Plugin
The Social Share, Social Login and Social Comments Plugin WordPress plugin before 7.13.64 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
PLUGIN
Before 7
CVE-2024-2836
Risk Score
Threat Entry
Updated 2025-05-12
CVE-2024-2583 - Before 7 Plugin
The WP Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 7.0.5 does not properly escape some of its shortcodes attributes before they are echoed back to users, making it possible for users with the contributor role to conduct Stored XSS attacks.
PLUGIN
Before 7
CVE-2024-2583
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-6290 - Before 7 Plugin
The SEOPress WordPress plugin before 7.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
PLUGIN
Before 7
CVE-2023-6290
Risk Score
Threat Entry
Updated 2025-06-02
CVE-2023-2252 - Before 7 Plugin
The Directorist WordPress plugin before 7.5.4 is vulnerable to Local File Inclusion as it does not validate the file parameter when importing CSV files.
PLUGIN
Before 7
CVE-2023-2252
Risk Score
Threat Entry
Updated 2025-04-23
CVE-2023-3936 - Before 7 Plugin
The Blog2Social WordPress plugin before 7.2.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
PLUGIN
Before 7
CVE-2023-3936
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-1273 - Before 7 Plugin
The ND Shortcodes WordPress plugin before 7.0 does not validate some shortcode attributes before using them to generate paths passed to include function/s, allowing any authenticated users such as subscriber to perform LFI attacks
PLUGIN
Before 7
CVE-2023-1273
Risk Score
Threat Entry
Updated 2024-12-12
CVE-2023-2779 - Before 7 Plugin
The Social Share, Social Login and Social Comments WordPress plugin before 7.13.52 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
PLUGIN
Before 7
CVE-2023-2779
Risk Score
Threat Entry
Updated 2025-02-11
CVE-2023-0983 - Before 7 Plugin
The stylish-cost-calculator-premium WordPress plugin before 7.9.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Stored Cross-Site Scripting which could be used against admins when viewing submissions submitted through the Email Quote Form.
PLUGIN
Before 7
CVE-2023-0983
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-0263 - Before 7 Plugin
The WP Yelp Review Slider WordPress plugin before 7.1 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as subscriber.
PLUGIN
Before 7
CVE-2023-0263
Risk Score
Threat Entry
Updated 2025-03-25
CVE-2023-0082 - Before 7 Plugin
The ExactMetrics WordPress plugin before 7.12.1 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
PLUGIN
Before 7
CVE-2023-0082
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-2763 - Before 7 Plugin
The WP Socializer WordPress plugin before 7.3 does not sanitise and escape some of its Icons settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
PLUGIN
Before 7
CVE-2022-2763
Risk Score
Threat Entry
Updated 2025-05-21
CVE-2022-1613 - Before 7 Plugin
The Restricted Site Access WordPress plugin before 7.3.2 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDR, which makes it possible to bypass IP-based limitations in certain situations.
PLUGIN
Before 7
CVE-2022-1613
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-3142 - Before 7 Plugin
The NEX-Forms WordPress plugin before 7.9.7 does not properly sanitise and escape user input before using it in SQL statements, leading to SQL injections. The attack can be executed by anyone who is permitted to view the forms statistics chart, by default administrators, however can be configured otherwise via the plugin settings.
PLUGIN
Before 7
CVE-2022-3142
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-2877 - Before 7 Plugin
The Titan Anti-spam & Security WordPress plugin before 7.3.1 does not properly checks HTTP headers in order to validate the origin IP address, allowing threat actors to bypass it's block feature by spoofing the headers.
PLUGIN
Before 7
CVE-2022-2877
Risk Score