Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2025-10-02
CVE-2025-9697 - Through 1 Plugin
The Ajax WooSearch WordPress plugin through 1.0.0 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection
PLUGIN
Through 1
CVE-2025-9697
Risk Score
Threat Entry
Updated 2025-11-13
CVE-2025-9587 - Through 1 Plugin
The CTL Behance Importer Lite WordPress plugin through 1.0 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.
PLUGIN
Through 1
CVE-2025-9587
Risk Score
Threat Entry
Updated 2026-02-13
CVE-2025-8280 - Through 1 Plugin
The Contact Form 7 reCAPTCHA WordPress plugin through 1.2.0 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers.
PLUGIN
Through 1
CVE-2025-8280
Risk Score
Threat Entry
Updated 2026-01-09
CVE-2025-7965 - Through 1 Plugin
The CBX Restaurant Booking WordPress plugin through 1.2.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
PLUGIN
Through 1
CVE-2025-7965
Risk Score
Threat Entry
Updated 2025-08-08
CVE-2025-6572 - Through 1 Plugin
The OpenStreetMap for Gutenberg and WPBakery Page Builder (formerly Visual Composer) WordPress plugin through 1.2.0 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
PLUGIN
Through 1
CVE-2025-6572
Risk Score
Threat Entry
Updated 2025-07-02
CVE-2025-4954 - Through 1 Plugin
The Axle Demo Importer WordPress plugin through 1.0.3 does not validate files to be uploaded, which could allow authenticated users (author and above) to upload arbitrary files such as PHP on the server
PLUGIN
Through 1
CVE-2025-4954
Risk Score
Threat Entry
Updated 2025-07-02
CVE-2025-4840 - Through 1 Plugin
The inprosysmedia-likes-dislikes-post WordPress plugin through 1.0.0 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection
PLUGIN
Through 1
CVE-2025-4840
Risk Score
Threat Entry
Updated 2025-06-10
CVE-2023-2921 - Through 1 Plugin
The Short URL WordPress plugin through 1.6.8 does not properly sanitise and escape a parameter before using it in SQL statement, leading to a SQL injection exploitable by users with relatively low privilege on the site, like subscribers.
PLUGIN
Through 1
CVE-2023-2921
Risk Score
Threat Entry
Updated 2025-06-04
CVE-2025-4578 - Through 1 Plugin
The File Provider WordPress plugin through 1.2.3 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection
PLUGIN
Through 1
CVE-2025-4578
Risk Score
Threat Entry
Updated 2025-06-04
CVE-2025-4580 - Through 1 Plugin
The File Provider WordPress plugin through 1.2.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
PLUGIN
Through 1
CVE-2025-4580
Risk Score
Threat Entry
Updated 2025-06-09
CVE-2025-4429 - Through 1 Plugin
The Gearside Developer Dashboard WordPress plugin through 1.0.72 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
PLUGIN
Through 1
CVE-2025-4429
Risk Score
Threat Entry
Updated 2025-06-12
CVE-2025-4190 - Through 1 Plugin
The CSV Mass Importer WordPress plugin through 1.2 does not properly validate uploaded files, allowing high privilege users such as admin to upload arbitrary files on the server even when they should not be allowed to (for example in multisite setup)
PLUGIN
Through 1
CVE-2025-4190
Risk Score
Threat Entry
Updated 2025-06-04
CVE-2025-2248 - Through 1 Plugin
The WP-PManager WordPress plugin through 1.2 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks
PLUGIN
Through 1
CVE-2025-2248
Risk Score
Threat Entry
Updated 2025-06-04
CVE-2025-2247 - Through 1 Plugin
The WP-PManager WordPress plugin through 1.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
PLUGIN
Through 1
CVE-2025-2247
Risk Score
Threat Entry
Updated 2025-08-01
CVE-2025-1303 - Through 1 Plugin
The Plugin Oficial WordPress plugin through 1.7.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against only unauthenticated users.
PLUGIN
Through 1
CVE-2025-1303
Risk Score
Threat Entry
Updated 2025-06-12
CVE-2025-1286 - Through 1 Plugin
The Download HTML TinyMCE Button WordPress plugin through 1.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
PLUGIN
Through 1
CVE-2025-1286
Risk Score
Threat Entry
Updated 2025-06-12
CVE-2025-1454 - Through 1 Plugin
The Ninja Pages WordPress plugin through 1.4.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
PLUGIN
Through 1
CVE-2025-1454
Risk Score
Threat Entry
Updated 2025-08-01
CVE-2025-1289 - Through 1 Plugin
The Plugin Oficial WordPress plugin through 1.7.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
PLUGIN
Through 1
CVE-2025-1289
Risk Score
Threat Entry
Updated 2025-06-12
CVE-2025-1033 - Through 1 Plugin
The Badgearoo WordPress plugin through 1.0.14 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
PLUGIN
Through 1
CVE-2025-1033
Risk Score
Threat Entry
Updated 2025-06-04
CVE-2024-8700 - Through 1 Plugin
The Event Calendar WordPress plugin through 1.0.4 does not check for authorization on delete actions, allowing unauthenticated users to delete arbitrary calendars.
PLUGIN
Through 1
CVE-2024-8700
Risk Score