Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-07-09
CVE-2026-11875 - Through 9 Plugin
The WP Support Plus Responsive Ticket System WordPress plugin through 9.1.2 does not sign or verify its guest-session cookie, allowing unauthenticated attackers to forge it and impersonate any ticket owner (identified by email address) to read, reply to, and close that person's support tickets.
PLUGIN
Through 9
CVE-2026-11875
Risk Score
Threat Entry
Updated 2026-06-30
CVE-2026-11589 - Through 9 Plugin
The WP Support Plus Responsive Ticket System WordPress plugin through 9.1.2 does not properly validate uploaded files, allowing unauthenticated users to upload files containing malicious JavaScript (such as HTML or SVG) to a publicly accessible location, leading to Stored Cross-Site Scripting attacks against site users and administrators.
PLUGIN
Through 9
CVE-2026-11589
Risk Score
Threat Entry
Updated 2026-06-30
CVE-2026-11590 - Through 9 Plugin
The WP Support Plus Responsive Ticket System WordPress plugin through 9.1.2 does not sanitize user-supplied array keys before using them in a SQL statement, allowing unauthenticated users to perform SQL injection attacks.
PLUGIN
Through 9
CVE-2026-11590
Risk Score
Threat Entry
Updated 2025-05-21
CVE-2025-1363 - Through 9 Plugin
The URL Shortener | Conversion Tracking | AB Testing | WooCommerce WordPress plugin through 9.0.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
PLUGIN
Through 9
CVE-2025-1363
Risk Score
Threat Entry
Updated 2025-05-21
CVE-2025-1362 - Through 9 Plugin
The URL Shortener | Conversion Tracking | AB Testing | WooCommerce WordPress plugin through 9.0.2 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting customers via CSRF attacks
PLUGIN
Through 9
CVE-2025-1362
Risk Score
Threat Entry
Updated 2025-05-21
CVE-2024-13868 - Through 9 Plugin
The URL Shortener | Conversion Tracking | AB Testing | WooCommerce WordPress plugin through 9.0.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
PLUGIN
Through 9
CVE-2024-13868
Risk Score
Threat Entry
Updated 2025-04-18
CVE-2024-2603 - Through 9 Plugin
The Salon booking system WordPress plugin through 9.6.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin (or editor depending on Salon booking system WordPress plugin through 9.6.5 configuration) to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
PLUGIN
Through 9
CVE-2024-2603
Risk Score
Threat Entry
Updated 2025-04-14
CVE-2024-2439 - Through 9 Plugin
The Salon booking system WordPress plugin through 9.6.5 does not sanitise and escape some of its settings, which could allow high privilege users such as Editor to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
PLUGIN
Through 9
CVE-2024-2439
Risk Score
Threat Entry
Updated 2025-04-14
CVE-2024-2429 - Through 9 Plugin
The Salon booking system WordPress plugin through 9.6.5 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
PLUGIN
Through 9
CVE-2024-2429
Risk Score