Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2024-11-21
CVE-2024-4384 - Through 1 Plugin
The CSSable Countdown WordPress plugin through 1.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
PLUGIN
Through 1
CVE-2024-4384
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-4475 - Through 1 Plugin
The WP Logs Book WordPress plugin through 1.0.1 does not have CSRF check when clearing logs, which could allow attackers to make a logged in admin clear the logs them via a CSRF attack
PLUGIN
Through 1
CVE-2024-4475
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-4474 - Through 1 Plugin
The WP Logs Book WordPress plugin through 1.0.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
PLUGIN
Through 1
CVE-2024-4474
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-4377 - Through 1 Plugin
The DOP Shortcodes WordPress plugin through 1.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
PLUGIN
Through 1
CVE-2024-4377
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-5172 - Through 1 Plugin
The Expert Invoice WordPress plugin through 1.0.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
PLUGIN
Through 1
CVE-2024-5172
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-3966 - Through 1 Plugin
The Pray For Me WordPress plugin through 1.0.4 does not sanitise and escape some parameters, which could unauthenticated visitors to perform Cross-Site Scripting attacks that trigger when an admin visits the Prayer Requests in the WP Admin
PLUGIN
Through 1
CVE-2024-3966
Risk Score
Threat Entry
Updated 2025-03-24
CVE-2024-4270 - Through 1 Plugin
The SVGMagic WordPress plugin through 1.1 does not sanitize SVG file contents, which enables users with at least the author role to SVG with malicious JavaScript to conduct Stored XSS attacks.
PLUGIN
Through 1
CVE-2024-4270
Risk Score
Threat Entry
Updated 2025-05-13
CVE-2024-3965 - Through 1 Plugin
The Pray For Me WordPress plugin through 1.0.4 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
PLUGIN
Through 1
CVE-2024-3965
Risk Score
Threat Entry
Updated 2025-05-13
CVE-2024-4271 - Through 1 Plugin
The SVGator WordPress plugin through 1.2.6 does not sanitize SVG file contents, which enables users with at least the author role to SVG with malicious JavaScript to conduct Stored XSS attacks.
PLUGIN
Through 1
CVE-2024-4271
Risk Score
Threat Entry
Updated 2025-07-03
CVE-2024-3754 - Through 1 Plugin
The Alemha watermarker WordPress plugin through 1.3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
PLUGIN
Through 1
CVE-2024-3754
Risk Score
Threat Entry
Updated 2025-03-14
CVE-2024-5003 - Through 1 Plugin
The WP Stacker WordPress plugin through 1.8.5 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack
PLUGIN
Through 1
CVE-2024-5003
Risk Score
Threat Entry
Updated 2025-05-06
CVE-2024-4856 - Through 1 Plugin
The FS Product Inquiry WordPress plugin through 1.1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin or unauthenticated users
PLUGIN
Through 1
CVE-2024-4856
Risk Score
Threat Entry
Updated 2025-05-06
CVE-2024-4857 - Through 1 Plugin
The FS Product Inquiry WordPress plugin through 1.1.1 does not sanitise and escape some form submissions, which could allow unauthenticated users to perform Stored Cross-Site Scripting attacks
PLUGIN
Through 1
CVE-2024-4857
Risk Score
Threat Entry
Updated 2025-05-21
CVE-2024-3937 - Through 1 Plugin
The Playlist for Youtube WordPress plugin through 1.32 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
PLUGIN
Through 1
CVE-2024-3937
Risk Score
Threat Entry
Updated 2025-05-19
CVE-2024-4535 - Through 1 Plugin
The KKProgressbar2 Free WordPress plugin through 1.1.4.2 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks
PLUGIN
Through 1
CVE-2024-4535
Risk Score
Threat Entry
Updated 2025-05-01
CVE-2024-4531 - Through 1 Plugin
The Business Card WordPress plugin through 1.0.0 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions such as editing cards via CSRF attacks
PLUGIN
Through 1
CVE-2024-4531
Risk Score
Threat Entry
Updated 2025-05-19
CVE-2024-4533 - Through 1 Plugin
The KKProgressbar2 Free WordPress plugin through 1.1.4.2 does not sanitize and escape a parameter before using it in a SQL statement, allowing admin users to perform SQL injection attacks
PLUGIN
Through 1
CVE-2024-4533
Risk Score
Threat Entry
Updated 2025-05-01
CVE-2024-4532 - Through 1 Plugin
The Business Card WordPress plugin through 1.0.0 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions such as deleting cards via CSRF attacks
PLUGIN
Through 1
CVE-2024-4532
Risk Score
Threat Entry
Updated 2025-05-19
CVE-2024-4534 - Through 1 Plugin
The KKProgressbar2 Free WordPress plugin through 1.1.4.2 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack
PLUGIN
Through 1
CVE-2024-4534
Risk Score
Threat Entry
Updated 2025-05-01
CVE-2024-4530 - Through 1 Plugin
The Business Card WordPress plugin through 1.0.0 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions such as editing card categories via CSRF attacks
PLUGIN
Through 1
CVE-2024-4530
Risk Score