Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2024-10-22
CVE-2024-9425 - Advanced Category And Custom Taxonomy Image Plugin
The Advanced Category and Custom Taxonomy Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ad_tax_image shortcode in all versions up to, and including, 1.0.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Advanced Category And Custom Taxonomy Image
CVE-2024-9425
Risk Score
Threat Entry
Updated 2024-10-21
CVE-2024-49231 - Wordpress Video Plugin
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Peter CyClop WordPress Video allows Stored XSS.This issue affects WordPress Video: from n/a through 1.0.
PLUGIN
Wordpress Video
CVE-2024-49231
Risk Score
Threat Entry
Updated 2024-10-21
CVE-2024-10057 - Rss Feed Widget Plugin
The RSS Feed Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's rfw-youtube-videos shortcode in all versions up to, and including, 2.9.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Rss Feed Widget
CVE-2024-10057
Risk Score
Threat Entry
Updated 2024-10-22
CVE-2024-10079 - Wp Easy Post Types Plugin
The WP Easy Post Types plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.4.4 via deserialization of untrusted input from the 'text' parameter in the 'ajax_import_content' function. This allows authenticated attackers, with subscriber-level permissions and above, to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
PLUGIN
Wp Easy Post Types
CVE-2024-10079
Risk Score
Threat Entry
Updated 2024-10-22
CVE-2024-10078 - Wp Easy Post Types Plugin
The WP Easy Post Types plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing capability check on multiple functions in all versions up to, and including, 1.4.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to add, modify, or delete plugin options and posts.
PLUGIN
Wp Easy Post Types
CVE-2024-10078
Risk Score
Threat Entry
Updated 2024-10-22
CVE-2024-10080 - Wp Easy Post Types Plugin
The WP Easy Post Types plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post meta in versions up to, and including, 1.4.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Wp Easy Post Types
CVE-2024-10080
Risk Score
Threat Entry
Updated 2024-10-22
CVE-2024-10055 - Click To Chat Plugin
The Click to Chat – WP Support All-in-One Floating Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpsaio_snapchat shortcode in all versions up to, and including, 2.3.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Click To Chat
CVE-2024-10055
Risk Score
Threat Entry
Updated 2024-10-22
CVE-2024-9703 - Arconix Shortcodes Plugin
The Arconix Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'button' shortcode in all versions up to, and including, 2.1.12 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Arconix Shortcodes
CVE-2024-9703
Risk Score
Threat Entry
Updated 2024-10-22
CVE-2024-9206 - Mas Companies For Wp Job Manager Plugin
The MAS Companies For WP Job Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.0.13. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
PLUGIN
Mas Companies For Wp Job Manager
CVE-2024-9206
Risk Score
Threat Entry
Updated 2024-10-22
CVE-2024-9892 - Add Widget After Content Plugin
The Add Widget After Content plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.4.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
PLUGIN
Add Widget After Content
CVE-2024-9892
Risk Score
Threat Entry
Updated 2024-10-22
CVE-2024-9848 - Product Customizer Light Plugin
The Product Customizer Light plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
PLUGIN
Product Customizer Light
CVE-2024-9848
Risk Score
Threat Entry
Updated 2024-10-22
CVE-2024-9452 - Branding Plugin
The Branding plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
PLUGIN
Branding
CVE-2024-9452
Risk Score
Threat Entry
Updated 2024-10-22
CVE-2024-9383 - Parcel Pro Plugin
The Parcel Pro plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'action' parameter in all versions up to, and including, 1.8.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
PLUGIN
Parcel Pro
CVE-2024-9383
Risk Score
Threat Entry
Updated 2024-10-22
CVE-2024-9382 - Gantry Plugin
The Gantry 4 Framework plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'override_id' parameter in all versions up to, and including, 4.1.21 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
PLUGIN
Gantry
CVE-2024-9382
Risk Score
Threat Entry
Updated 2024-10-22
CVE-2024-9373 - Elemenda Plugin
The Elemenda plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 0.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
PLUGIN
Elemenda
CVE-2024-9373
Risk Score
Threat Entry
Updated 2024-10-22
CVE-2024-9366 - Easy Menu Manager Plugin
The Easy Menu Manager | WPZest plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
PLUGIN
Easy Menu Manager
CVE-2024-9366
Risk Score
Threat Entry
Updated 2024-10-29
CVE-2024-9350 - Woo Shipping Dpd Baltic Plugin
The DPD Baltic Shipping plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'search_value' parameter in all versions up to, and including, 1.2.83 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
PLUGIN
Woo Shipping Dpd Baltic
CVE-2024-9350
Risk Score
Threat Entry
Updated 2024-10-22
CVE-2024-9364 - Sendgrid Plugin
The SendGrid for WordPress plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'wp_mailplus_clear_logs' function in all versions up to, and including, 1.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete the plugin's log files.
PLUGIN
Sendgrid
CVE-2024-9364
Risk Score
Threat Entry
Updated 2024-11-01
CVE-2024-9361 - Bulk Images Optimizer Plugin
The Bulk images optimizer: Resize, optimize, convert to webp, rename … plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'save_configuration' function in all versions up to, and including, 2.0.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update plugin options.
PLUGIN
Bulk Images Optimizer
CVE-2024-9361
Risk Score
Threat Entry
Updated 2024-10-29
CVE-2024-8916 - Suki Sites Import Plugin
The Suki Sites Import plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
PLUGIN
Suki Sites Import
CVE-2024-8916
Risk Score