sales@hackhalt.com
Free Download

Live Vulnerability Intelligence

Threat Database

Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.

Total179
Critical16
High55
Medium106
Reset
Showing 21-40 of 179 records
Threat Entry Updated 2026-06-17

WordPress Core - Broken Access Control (CVE-2024-43235)

Missing Authorization vulnerability in MetaBox.Io Meta Box – WordPress Custom Fields Framework allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Meta Box – WordPress Custom Fields Framework: from n/a through 5.9.10.

CORE WordPress Core

CVE-2024-43235

HIGH CVSS 7.1 2024-11-01
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

WordPress Core - Cross-Site Scripting (XSS) (CVE-2022-4973)

WordPress Core, in versions up to 6.0.2, is vulnerable to Authenticated Stored Cross-Site Scripting that can be exploited by users with access to the WordPress post and page editor, typically consisting of Authors, Contributors, and Editors making it possible to inject arbitrary web scripts into posts and pages that execute if the the_meta(); function is called on that page.

CORE WordPress Core

CVE-2022-4973

MEDIUM CVSS 4.9 2024-10-16
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

WordPress Core - Path Traversal (CVE-2024-32111)

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Automattic WordPress allows Relative Path Traversal.This issue affects WordPress: from 6.5 through 6.5.4, from 6.4 through 6.4.4, from 6.3 through 6.3.4, from 6.2 through 6.2.5, from 6.1 through 6.1.6, from 6.0 through 6.0.8, from 5.9 through 5.9.9, from 5.8 through 5.8.9, from 5.7 through 5.7.11, from 5.6 through 5.6.13, from 5.5 through 5.5.14, from 5.4 through 5.4.15, from 5.3 through 5.3.17, from 5.2 through 5.2.20, from 5.1 through 5.1.18, from 5.0 through 5.0.21, from 4.9 through 4.9.25,…

CORE WordPress Core

CVE-2024-32111

MEDIUM CVSS 5.0 2024-06-25
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

WordPress Core - Cross-Site Scripting (XSS) (CVE-2024-31111)

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Automattic WordPress allows Stored XSS.This issue affects WordPress: from 6.5 through 6.5.4, from 6.4 through 6.4.4, from 6.3 through 6.3.4, from 6.2 through 6.2.5, from 6.1 through 6.1.6, from 6.0 through 6.0.8, from 5.9 through 5.9.9.

CORE WordPress Core

CVE-2024-31111

MEDIUM CVSS 6.5 2024-06-25
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

WordPress Core - Cross-Site Scripting (XSS) (CVE-2024-6307)

WordPress Core is vulnerable to Stored Cross-Site Scripting via the HTML API in various versions prior to 6.5.5 due to insufficient input sanitization and output escaping on URLs. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CORE WordPress Core

CVE-2024-6307

MEDIUM CVSS 6.4 2024-06-25
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

WordPress Core - Broken Access Control (CVE-2024-32692)

Missing Authorization vulnerability in QuanticaLabs Chauffeur Taxi Booking System for WordPress allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Chauffeur Taxi Booking System for WordPress: from n/a through 6.9.

CORE WordPress Core

CVE-2024-32692

HIGH CVSS 8.2 2024-05-17
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

WordPress Core - Cross-Site Scripting (XSS) (CVE-2024-34573)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pootlepress Pootle Pagebuilder – WordPress Page builder allows Stored XSS.This issue affects Pootle Pagebuilder – WordPress Page builder: from n/a through 5.7.1.

CORE WordPress Core

CVE-2024-34573

MEDIUM CVSS 6.5 2024-05-08
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

WordPress Core - Cross-Site Scripting (XSS) (CVE-2024-4439)

WordPress Core is vulnerable to Stored Cross-Site Scripting via user display names in the Avatar block in various versions up to 6.5.2 due to insufficient output escaping on the display name. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. In addition, it also makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that have the comment block present and display the comment author's avatar.

CORE WordPress Core

CVE-2024-4439

HIGH CVSS 7.2 2024-05-03
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

WordPress - Information Disclosure (CVE-2023-5692)

WordPress Core is vulnerable to Sensitive Information Exposure in versions up to, and including, 6.4.3 via the redirect_guess_404_permalink function. This can allow unauthenticated attackers to expose the slug of a custom post whose 'publicly_queryable' post status has been set to 'false'.

PLUGIN WordPress

CVE-2023-5692

MEDIUM CVSS 5.3 2024-04-05
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

WordPress Core - Remote Code Execution (CVE-2024-31210)

WordPress is an open publishing platform for the Web. It's possible for a file of a type other than a zip file to be submitted as a new plugin by an administrative user on the Plugins -> Add New -> Upload Plugin screen in WordPress. If FTP credentials are requested for installation (in order to move the file into place outside of the `uploads` directory) then the uploaded file remains temporary available in the Media Library despite it not being allowed. If the `DISALLOW_FILE_EDIT` constant is set to `true` on…

CORE WordPress Core

CVE-2024-31210

HIGH CVSS 7.6 2024-04-04
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

WordPress Core - Security Vulnerability (CVE-2024-31211)

WordPress is an open publishing platform for the Web. Unserialization of instances of the `WP_HTML_Token` class allows for code execution via its `__destruct()` magic method. This issue was fixed in WordPress 6.4.2 on December 6th, 2023. Versions prior to 6.4.0 are not affected.

CORE WordPress Core

CVE-2024-31211

MEDIUM CVSS 5.5 2024-04-04
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

WordPress Core - Security Vulnerability (CVE-2023-5561)

WordPress does not properly restrict which user fields are searchable via the REST API, allowing unauthenticated attackers to discern the email addresses of users who have published public posts on an affected website via an Oracle style attack

CORE WordPress Core

CVE-2023-5561

MEDIUM CVSS 5.3 2023-10-16
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

WordPress Core - Information Disclosure (CVE-2023-39999)

Exposure of Sensitive Information to an Unauthorized Actor in WordPress from 6.3 through 6.3.1, from 6.2 through 6.2.2, from 6.1 through 6.13, from 6.0 through 6.0.5, from 5.9 through 5.9.7, from 5.8 through 5.8.7, from 5.7 through 5.7.9, from 5.6 through 5.6.11, from 5.5 through 5.5.12, from 5.4 through 5.4.13, from 5.3 through 5.3.15, from 5.2 through 5.2.18, from 5.1 through 5.1.16, from 5.0 through 5.0.19, from 4.9 through 4.9.23, from 4.8 through 4.8.22, from 4.7 through 4.7.26, from 4.6 through 4.6.26, from 4.5 through 4.5.29, from 4.4 through 4.4.30, from…

CORE WordPress Core

CVE-2023-39999

MEDIUM CVSS 4.3 2023-10-13
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

WordPress Core - Path Traversal (CVE-2023-2745)

WordPress Core is vulnerable to Directory Traversal in versions up to, and including, 6.2, via the ‘wp_lang’ parameter. This allows unauthenticated attackers to access and load arbitrary translation files. In cases where an attacker is able to upload a crafted translation file onto the site, such as via an upload form, this could be also used to perform a Cross-Site Scripting attack.

CORE WordPress Core

CVE-2023-2745

MEDIUM CVSS 5.4 2023-05-17
Open Full Technical Breakdown

WordPress security that blocks attacks before they land.

sales@hackhalt.com

Product

Resources

Company

© Hack Halt Inc. All rights reserved.