Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-09-21
Hide My Wp - Security Vulnerability (CVE-2026-7527)
The WP Ghost (Hide My WP Ghost) – Security & Firewall plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 7.0.02. This is due to the plugin not properly validating user input. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into clicking on a specially crafted link. Exploitation requires tricking a logged-in user into clicking a crafted logout URL; the victim is fully logged out via wp_logout() before the malicious redirect is…
PLUGIN
Hide My Wp
CVE-2026-7527
Risk Score
Threat Entry
Updated 2026-09-08
Hide My Wp - Server-Side Request Forgery (SSRF) (CVE-2026-81806)
Server-Side Request Forgery (SSRF) vulnerability in John Darrel Hide My WP Ghost allows Server Side Request Forgery. This issue affects Hide My WP Ghost: from n/a through 7.0.09.
PLUGIN
Hide My Wp
CVE-2026-81806
Risk Score
Threat Entry
Updated 2026-07-27
Hide My Wp - Security Vulnerability (CVE-2026-59546)
Subscriber Broken Authentication in Hide My WP Ghost
PLUGIN
Hide My Wp
CVE-2026-59546
Risk Score
Threat Entry
Updated 2026-07-24
Hide My Wp - Open Redirect (CVE-2026-39484)
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in John Darrel Hide My WP Ghost hide-my-wp allows Phishing.This issue affects Hide My WP Ghost: from n/a through < 7.0.00.
PLUGIN
Hide My Wp
CVE-2026-39484
Risk Score
Threat Entry
Updated 2026-06-17
Hide My Wp - Path Traversal (CVE-2025-2056)
The WP Ghost (Hide My WP Ghost) – Security & Firewall plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 5.4.01 via the showFile function. This makes it possible for unauthenticated attackers to read the contents of specific file types on the server, which can contain sensitive information.
PLUGIN
Hide My Wp
CVE-2025-2056
Risk Score
Threat Entry
Updated 2026-06-17
Hide My Wp - Cross-Site Scripting (XSS) (CVE-2024-10825)
The Hide My WP Ghost – Security & Firewall plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the URL in all versions up to, and including, 5.3.01 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick an administrative user into performing an action such as clicking on a link.
PLUGIN
Hide My Wp
CVE-2024-10825
Risk Score
Threat Entry
Updated 2026-06-17
Hide My Wp - Security Vulnerability (CVE-2022-4537)
The Hide My WP Ghost – Security Plugin plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 5.0.18. This is due to insufficient restrictions on where the IP Address information is being retrieved for request logging and login restrictions. Attackers can supply the X-Forwarded-For header with with a different IP Address that will be logged and can be used to bypass settings that may have blocked out an IP address from logging in.
PLUGIN
Hide My Wp
CVE-2022-4537
Risk Score
Threat Entry
Updated 2026-06-17
Hide My Wp - SQL Injection (CVE-2022-4681)
The Hide My WP WordPress plugin before 6.2.9 does not properly sanitize and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.
PLUGIN
Hide My Wp
CVE-2022-4681
Risk Score
Threat Entry
Updated 2026-06-17
Hide My Wp - SQL Injection (CVE-2021-36916)
The SQL injection vulnerability in the Hide My WP WordPress plugin (versions
PLUGIN
Hide My Wp
CVE-2021-36916
Risk Score
Threat Entry
Updated 2026-06-17
Hide My Wp - Security Vulnerability (CVE-2021-36917)
WordPress Hide My WP plugin (versions
PLUGIN
Hide My Wp
CVE-2021-36917
Risk Score