Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2025-06-11
CVE-2024-2643 - And Sticky Header For Any Plugin
The Floating Notification Bar, Sticky Menu on Scroll, Announcement Banner, and Sticky Header for Any WordPress plugin before 2.6.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
PLUGIN
And Sticky Header For Any
CVE-2024-2643
Risk Score
Threat Entry
Updated 2025-06-11
CVE-2024-1663 - Ultimate Noindex Nofollow Tool Ii Plugin
The Ultimate Noindex Nofollow Tool II WordPress plugin before 1.3.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
PLUGIN
Ultimate Noindex Nofollow Tool Ii
CVE-2024-1663
Risk Score
Threat Entry
Updated 2025-06-11
CVE-2024-13865 - Through 4 Plugin
The S3Player WordPress plugin through 4.2.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against only unauthenticated users.
PLUGIN
Through 4
CVE-2024-13865
Risk Score
Threat Entry
Updated 2025-06-10
CVE-2024-13828 - Through 1 Plugin
The Badgearoo WordPress plugin through 1.0.14 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
PLUGIN
Through 1
CVE-2024-13828
Risk Score
Threat Entry
Updated 2025-06-10
CVE-2024-13823 - 360 Product Rotation Plugin
The 360 Product Rotation WordPress plugin through 1.5.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against only unauthenticated users.
PLUGIN
360 Product Rotation
CVE-2024-13823
Risk Score
Threat Entry
Updated 2025-05-23
CVE-2024-13730 - Podlove Podcast Publisher Plugin
The Podlove Podcast Publisher WordPress plugin before 4.2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
PLUGIN
Podlove Podcast Publisher
CVE-2024-13730
Risk Score
Threat Entry
Updated 2025-06-10
CVE-2024-13727 - Before 2 Plugin
The MemberSpace WordPress plugin before 2.1.14 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against only unauthenticated users.
PLUGIN
Before 2
CVE-2024-13727
Risk Score
Threat Entry
Updated 2025-06-10
CVE-2024-13619 - Before 8 Plugin
The LifterLMS WordPress plugin before 8.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
PLUGIN
Before 8
CVE-2024-13619
Risk Score
Threat Entry
Updated 2025-05-23
CVE-2024-13729 - Podlove Podcast Publisher Plugin
The Podlove Podcast Publisher WordPress plugin before 4.1.24 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
PLUGIN
Podlove Podcast Publisher
CVE-2024-13729
Risk Score
Threat Entry
Updated 2025-06-10
CVE-2024-13621 - Gdpr Framework By Data443 Plugin
The GDPR Framework By Data443 WordPress plugin before 2.2.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
PLUGIN
Gdpr Framework By Data443
CVE-2024-13621
Risk Score
Threat Entry
Updated 2025-06-10
CVE-2024-13616 - Before 1 Plugin
The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.7.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
PLUGIN
Before 1
CVE-2024-13616
Risk Score
Threat Entry
Updated 2025-05-28
CVE-2024-13486 - Icegram Engage Plugin
The Icegram Engage WordPress plugin before 3.1.32 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
PLUGIN
Icegram Engage
CVE-2024-13486
Risk Score
Threat Entry
Updated 2025-05-28
CVE-2024-13482 - Icegram Engage Plugin
The Icegram Engage WordPress plugin before 3.1.32 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
PLUGIN
Icegram Engage
CVE-2024-13482
Risk Score
Threat Entry
Updated 2025-06-05
CVE-2024-13384 - Slider In Rbs Image Gallery Plugin
The Photo Gallery, Images, Slider in Rbs Image Gallery WordPress plugin before 3.2.24 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
PLUGIN
Slider In Rbs Image Gallery
CVE-2024-13384
Risk Score
Threat Entry
Updated 2025-06-10
CVE-2024-13383 - Before 2 Plugin
The HD Quiz WordPress plugin before 2.0.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
PLUGIN
Before 2
CVE-2024-13383
Risk Score
Threat Entry
Updated 2025-05-23
CVE-2024-13382 - Before 5 Plugin
The Calculated Fields Form WordPress plugin before 5.2.64 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
PLUGIN
Before 5
CVE-2024-13382
Risk Score
Threat Entry
Updated 2025-06-10
CVE-2024-13357 - Before 3 Plugin
The Ditty WordPress plugin before 3.1.52 does not sanitise and escape some of its settings, which could allow high privilege users such as author to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
PLUGIN
Before 3
CVE-2024-13357
Risk Score
Threat Entry
Updated 2025-06-10
CVE-2024-13313 - Through 7 Plugin
The AWeber WordPress plugin through 7.3.20 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
PLUGIN
Through 7
CVE-2024-13313
Risk Score
Threat Entry
Updated 2025-05-22
CVE-2024-13128 - Before 4 Plugin
The LearnPress WordPress plugin before 4.2.7.5.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
PLUGIN
Before 4
CVE-2024-13128
Risk Score
Threat Entry
Updated 2025-05-22
CVE-2024-13127 - Before 4 Plugin
The LearnPress WordPress plugin before 4.2.7.5.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
PLUGIN
Before 4
CVE-2024-13127
Risk Score