Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-07-21
Woody Code Snippets - Remote Code Execution (CVE-2017-20251)
WordPress Insert PHP plugin versions before 3.3.1 contain a PHP code injection vulnerability that allows unauthenticated attackers to execute arbitrary PHP code by injecting malicious shortcodes through the WordPress REST API. Attackers can send POST requests to the wp-json/wp/v2/posts endpoint with crafted content containing insert_php shortcodes to include and execute remote PHP files on the server.
THEME
Woody Code Snippets
CVE-2017-20251
Risk Score
Threat Entry
Updated 2026-06-17
Woody Code Snippets - Remote Code Execution (CVE-2024-3105)
The Woody code snippets – Insert Header Footer Code, AdSense Ads plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.5.0 via the 'insert_php' shortcode. This is due to the plugin not restricting the usage of the functionality to high level authorized users. This makes it possible for authenticated attackers, with contributor-level access and above, to execute code on the server.
THEME
Woody Code Snippets
CVE-2024-3105
Risk Score
Threat Entry
Updated 2026-06-17
Woody Code Snippets - Cross-Site Scripting (XSS) (CVE-2024-35751)
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Creative Motion, Will Bontrager Software, LLC Woody ad snippets allows Stored XSS.This issue affects Woody ad snippets: from n/a through 2.4.10.
PLUGIN
Woody Code Snippets
CVE-2024-35751
Risk Score
Threat Entry
Updated 2026-06-17
Woody Code Snippets - Cross-Site Request Forgery (CSRF) (CVE-2020-36759)
The Woody code snippets plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.3.9. This is due to missing or incorrect nonce validation on the runActions() function. This makes it possible for unauthenticated attackers to activate and deactivate snippets via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
PLUGIN
Woody Code Snippets
CVE-2020-36759
Risk Score