Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2024-11-21
CVE-2024-6073 - Before 8 Plugin
The wp-cart-for-digital-products WordPress plugin before 8.5.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
PLUGIN
Before 8
CVE-2024-6073
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-6072 - Before 8 Plugin
The wp-cart-for-digital-products WordPress plugin before 8.5.5 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers
PLUGIN
Before 8
CVE-2024-6072
Risk Score
Threat Entry
Updated 2025-03-18
CVE-2024-4094 - Before 8 Plugin
The Simple Share Buttons Adder WordPress plugin before 8.5.1 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
PLUGIN
Before 8
CVE-2024-4094
Risk Score
Threat Entry
Updated 2025-05-08
CVE-2024-3591 - Before 8 Plugin
The Geo Controller WordPress plugin before 8.6.5 unserializes user input via some of its AJAX actions and REST API routes, which could allow unauthenticated users to perform PHP Object Injection when a suitable gadget is present on the blog.
PLUGIN
Before 8
CVE-2024-3591
Risk Score
Threat Entry
Updated 2025-05-27
CVE-2024-1310 - Before 8 Plugin
The WooCommerce WordPress plugin before 8.6 does not prevent users with at least the contributor role from leaking products they shouldn't have access to. (e.g. private, draft and trashed products)
PLUGIN
Before 8
CVE-2024-1310
Risk Score
Threat Entry
Updated 2025-05-07
CVE-2024-0566 - Before 8 Plugin
The Smart Manager WordPress plugin before 8.28.0 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin.
PLUGIN
Before 8
CVE-2024-0566
Risk Score
Threat Entry
Updated 2025-06-11
CVE-2023-6824 - Before 8 Plugin
The WP Customer Area WordPress plugin before 8.2.1 does not properly validates user capabilities in some of its AJAX actions, allowing any users to retrieve other user's account address.
PLUGIN
Before 8
CVE-2023-6824
Risk Score
Threat Entry
Updated 2025-06-20
CVE-2023-6741 - Before 8 Plugin
The WP Customer Area WordPress plugin before 8.2.1 does not properly validate users capabilities in some of its AJAX actions, allowing malicious users to edit other users' account address.
PLUGIN
Before 8
CVE-2023-6741
Risk Score
Threat Entry
Updated 2025-06-18
CVE-2023-6529 - Before 8 Plugin
The WP VR WordPress plugin before 8.3.15 does not authorisation and CSRF in a function hooked to admin_init, allowing unauthenticated users to downgrade the plugin, thus leading to Reflected or Stored XSS, as previous versions have such vulnerabilities.
PLUGIN
Before 8
CVE-2023-6529
Risk Score
Threat Entry
Updated 2025-04-23
CVE-2023-3575 - Before 8 Plugin
The Quiz And Survey Master WordPress plugin before 8.1.11 does not properly sanitize and escape question titles, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks
PLUGIN
Before 8
CVE-2023-3575
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-0439 - Before 8 Plugin
The NEX-Forms WordPress plugin before 8.4.4 does not escape its form name, which could lead to Stored Cross-Site Scripting issues. By default only SuperAdmins (in multisite) / admins (in single site) can create forms, however there is a settings allowing them to give lower roles access to such feature.
PLUGIN
Before 8
CVE-2023-0439
Risk Score
Threat Entry
Updated 2025-01-14
CVE-2023-0233 - Before 8 Plugin
The ActiveCampaign WordPress plugin before 8.1.12 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
PLUGIN
Before 8
CVE-2023-0233
Risk Score
Threat Entry
Updated 2025-02-04
CVE-2023-2114 - Before 8 Plugin
The NEX-Forms WordPress plugin before 8.4 does not properly escape the `table` parameter, which is populated with user input, before concatenating it to an SQL query.
PLUGIN
Before 8
CVE-2023-2114
Risk Score
Threat Entry
Updated 2025-02-04
CVE-2023-1414 - Before 8 Plugin
The WP VR WordPress plugin before 8.3.0 does not have authorisation and CSRF checks in various AJAX actions, one in particular could allow any authenticated users, such as subscriber to update arbitrary tours
PLUGIN
Before 8
CVE-2023-1414
Risk Score
Threat Entry
Updated 2025-04-23
CVE-2023-1413 - Before 8 Plugin
The WP VR WordPress plugin before 8.2.9 does not sanitise and escape some parameters before outputting them back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
PLUGIN
Before 8
CVE-2023-1413
Risk Score
Threat Entry
Updated 2025-02-19
CVE-2023-0272 - Before 8 Plugin
The NEX-Forms WordPress plugin before 8.3.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
PLUGIN
Before 8
CVE-2023-0272
Risk Score
Threat Entry
Updated 2025-03-25
CVE-2023-0174 - Before 8 Plugin
The WP VR WordPress plugin before 8.2.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
PLUGIN
Before 8
CVE-2023-0174
Risk Score
Threat Entry
Updated 2025-03-25
CVE-2023-0081 - Before 8 Plugin
The MonsterInsights WordPress plugin before 8.12.1 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
PLUGIN
Before 8
CVE-2023-0081
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-3209 - Before 8 Theme
The soledad WordPress theme before 8.2.5 does not sanitise the {id,datafilter[type],...} parameters in its penci_more_slist_post_ajax AJAX action, leading to a Reflected Cross-Site Scripting (XSS) vulnerability.
THEME
Before 8
CVE-2022-3209
Risk Score
Threat Entry
Updated 2025-05-22
CVE-2022-3074 - Before 8 Plugin
The Slider Hero WordPress plugin before 8.4.4 does not escape the slider Name, which could allow high-privileged users to perform Cross-Site Scripting attacks.
PLUGIN
Before 8
CVE-2022-3074
Risk Score