Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2024-11-21
CVE-2024-5169 - Video Widget Plugin
The Video Widget WordPress plugin through 1.2.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
PLUGIN
Video Widget
CVE-2024-5169
Risk Score
Threat Entry
Updated 2025-04-30
CVE-2024-4959 - Frontend Checklist Plugin
The Frontend Checklist WordPress plugin through 2.3.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
PLUGIN
Frontend Checklist
CVE-2024-4959
Risk Score
Threat Entry
Updated 2025-04-30
CVE-2024-4957 - Frontend Checklist Plugin
The Frontend Checklist WordPress plugin through 2.3.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
PLUGIN
Frontend Checklist
CVE-2024-4957
Risk Score
Threat Entry
Updated 2025-05-19
CVE-2024-3633 - Webp Svg Support Plugin
The WebP & SVG Support WordPress plugin through 1.4.0 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads.
PLUGIN
Webp Svg Support
CVE-2024-3633
Risk Score
Threat Entry
Updated 2025-01-28
CVE-2024-5173 - Ht Mega Plugin
The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Video player widget settings in all versions up to, and including, 2.5.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Ht Mega
CVE-2024-5173
Risk Score
Threat Entry
Updated 2025-07-09
CVE-2024-4869 - Wp Cookie Consent Plugin
The WP Cookie Consent ( for GDPR, CCPA & ePrivacy ) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Client-IP’ header in all versions up to, and including, 3.2.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Wp Cookie Consent
CVE-2024-4869
Risk Score
Threat Entry
Updated 2025-12-15
CVE-2024-6028 - Quiz Maker Plugin
The Quiz Maker plugin for WordPress is vulnerable to time-based SQL Injection via the 'ays_questions' parameter in all versions up to, and including, 6.5.8.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
PLUGIN
Quiz Maker
CVE-2024-6028
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-3249 - Zita Elementor Site Library Plugin
The Zita Elementor Site Library plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the import_xml_data, xml_data_import, import_option_data, import_widgets, and import_customizer_settings functions in all versions up to, and including, 1.6.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to create pages, update certain options, including WooCommerce page titles and Elementor settings, import widgets, and update the plugin's customizer settings and the WordPress custom CSS. NOTE: This vulnerability was partially fixed in version 1.6.2.
PLUGIN
Zita Elementor Site Library
CVE-2024-3249
Risk Score
Threat Entry
Updated 2025-03-06
CVE-2024-5431 - Wpcafe Plugin
The WPCafe – Online Food Ordering, Restaurant Menu, Delivery, and Reservations for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.2.25 via the reservation_extra_field shortcode parameter. This makes it possible for authenticated attackers, with Contributor-level access and above, to include remote files on the server, potentially resulting in code execution
PLUGIN
Wpcafe
CVE-2024-5431
Risk Score
Threat Entry
Updated 2025-05-19
CVE-2024-4757 - Logo Manager For Enamad Plugin
The Logo Manager For Enamad WordPress plugin through 0.7.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack
PLUGIN
Logo Manager For Enamad
CVE-2024-4757
Risk Score
Threat Entry
Updated 2025-05-19
CVE-2024-4759 - Mime Types Extended Plugin
The Mime Types Extended WordPress plugin through 0.11 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads.
PLUGIN
Mime Types Extended
CVE-2024-4759
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-6297 - Blaze Widget Plugin
Several plugins for WordPress hosted on WordPress.org have been compromised and injected with malicious PHP scripts. A malicious threat actor compromised the source code of various plugins and injected code that exfiltrates database credentials and is used to create new, malicious, administrator users and send that data back to a server. Currently, not all plugins have been patched and we strongly recommend uninstalling the plugins for the time being and running a complete malware scan.
PLUGIN
Blaze Widget
CVE-2024-6297
Risk Score
Threat Entry
Updated 2025-05-19
CVE-2024-4900 - Before 7 Plugin
The SEOPress WordPress plugin before 7.8 does not validate and escape one of its Post settings, which could allow contributor and above role to perform Open redirect attacks against any user viewing a malicious post
PLUGIN
Before 7
CVE-2024-4900
Risk Score
Threat Entry
Updated 2025-05-19
CVE-2024-4899 - Before 7 Plugin
The SEOPress WordPress plugin before 7.8 does not sanitise and escape some of its Post settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks.
PLUGIN
Before 7
CVE-2024-4899
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-5596 - Armember Premium Plugin
The ARMember Premium plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 6.7. This is due to incorrectly implemented nonce validation function on multiple functions. This makes it possible for unauthenticated attackers to modify, or delete user meta and plugin options which can lead to limited privilege escalation.
PLUGIN
Armember Premium
CVE-2024-5596
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-3593 - Ubermenu Plugin
The UberMenu plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.8.3. This is due to missing or incorrect nonce validation on the ubermenu_delete_all_item_settings and ubermenu_reset_settings functions. This makes it possible for unauthenticated attackers to delete and reset the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
PLUGIN
Ubermenu
CVE-2024-3593
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-4874 - Bricks Plugin
The Bricks Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.9.8 via the postId parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Contributor-level access and above, to modify posts and pages created by other users including admins. As a requirement for this, an admin would have to enable access to the editor specifically for such a user or enable it for all users with a certain user account type.
PLUGIN
Bricks
CVE-2024-4874
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-5966 - Grey Opaque Plugin
The Grey Opaque theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter within the theme's Download-Button shortcode in all versions up to, and including, 2.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Grey Opaque
CVE-2024-5966
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-5965 - Mosaic Plugin
The Mosaic theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘link’ parameter within the theme's Button shortcode in all versions up to, and including, 1.7.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Mosaic
CVE-2024-5965
Risk Score
Threat Entry
Updated 2025-06-10
CVE-2024-5791 - Online Booking Scheduling Calendar Plugin
The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wp_id' parameter in all versions up to, and including, 4.4.2 due to missing authorization checks on processAction function, as well as insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that will execute whenever a user accesses a wp-admin dashboard.
PLUGIN
Online Booking Scheduling Calendar
CVE-2024-5791
Risk Score